@aws/nx-plugin 1.0.0-rc.65 → 1.0.0-rc.66

package/src/migrations/latest/add-deploy-sandbox-target/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/add-deploy-sandbox-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { INFRA_APP_GENERATOR_INFO } from '../../../infra/app/generator';\nimport { captureGritQLVariable } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx';\nimport { sortObjectKeys } from '../../../utils/object';\n\n/**\n * CDK infrastructure projects gained a `deploy-sandbox` target, which deploys the\n * sandbox stage without the user having to spell out its stage pattern\n * (`nx deploy-sandbox infra` rather than `nx deploy infra \"my-app-infra-sandbox/*\"`).\n *\n * The stage id is read from `main.ts` rather than recomputed from the project\n * name, so a project whose sandbox stage has been renamed gets a target that\n * deploys the stage it actually declares.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst TARGET = 'deploy-sandbox';\n\n/**\n * Matches `new ApplicationStage(app, '<id>-sandbox', { ... })`, binding the\n * quoted stage id. The regex spans the quotes because it is matched against the\n * whole string literal node; both quote styles are accepted since the user's\n * formatter may have rewritten them.\n *\n * `main.ts` can declare several stages (beta, prod), so the pattern selects the\n * sandbox one rather than whichever comes first.\n */\nconst SANDBOX_STAGE_PATTERN =\n  '`new ApplicationStage($app, $id, $props)` where { $id <: r\"[\\'\\\\\"].*-sandbox[\\'\\\\\"]\" }';\n\n/** The id of the sandbox stage a project's `main.ts` instantiates. */\nconst sandboxStageId = async (\n  tree: Tree,\n  projectRoot: string,\n): Promise<string | undefined> => {\n  const captured = await captureGritQLVariable(\n    tree,\n    joinPathFragments(projectRoot, 'src', 'main.ts'),\n    SANDBOX_STAGE_PATTERN,\n    'id',\n  );\n  // The binding keeps the quotes from the source.\n  return captured?.slice(1, -1);\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (\n      generator !== INFRA_APP_GENERATOR_INFO.id ||\n      project.targets?.[TARGET]\n    ) {\n      // Not a CDK infrastructure project, or the target is already present.\n      continue;\n    }\n\n    // The new target mirrors `deploy`, so it inherits whatever that resolved to\n    // when the project was generated: the `tsx` credential-resolving script\n    // under `stageConfig`, plain `cdk deploy` otherwise.\n    const deploy = project.targets.deploy;\n    const command = deploy?.options?.command;\n    const mainPath = joinPathFragments(project.root, 'src/main.ts');\n    const stageId = await sandboxStageId(tree, project.root);\n\n    if (typeof command !== 'string') {\n      nextSteps.push(\n        `Add a '${TARGET}' target to ${projectName} by hand if necessary — its 'deploy' target no longer matches the shape the generator produced.`,\n      );\n      continue;\n    }\n    if (!stageId) {\n      nextSteps.push(\n        `Add a '${TARGET}' target to ${projectName} by hand if necessary — no sandbox stage was found in ${mainPath}.`,\n      );\n      continue;\n    }\n\n    project.targets[TARGET] = normalizeTargetKeyOrder({\n      executor: deploy.executor,\n      ...(deploy.dependsOn ? { dependsOn: [...deploy.dependsOn] } : {}),\n      // Quoted so the shell does not glob the `*`.\n      options: { ...deploy.options, command: `${command} \"${stageId}/*\"` },\n    });\n    updateProjectConfiguration(tree, projectName, {\n      ...project,\n      targets: sortObjectKeys(project.targets),\n    });\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","INFRA_APP_GENERATOR_INFO","captureGritQLVariable","formatFilesInSubtree","normalizeTargetKeyOrder","sortObjectKeys","TARGET","SANDBOX_STAGE_PATTERN","sandboxStageId","tree","projectRoot","captured","slice","migration","nextSteps","projectName","project","generator","metadata","id","targets","deploy","command","options","mainPath","root","stageId","push","executor","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,wBAAwB,QAAQ,kCAA+B;AACxE,SAASC,qBAAqB,QAAQ,wBAAqB;AAC3D,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,uBAAuB,QAAQ,uBAAoB;AAC5D,SAASC,cAAc,QAAQ,2BAAwB;AAEvD;;;;;;;;;;;;CAYC,GAED,MAAMC,SAAS;AAEf;;;;;;;;CAQC,GACD,MAAMC,wBACJ;AAEF,oEAAoE,GACpE,MAAMC,iBAAiB,OACrBC,MACAC;IAEA,MAAMC,WAAW,MAAMT,sBACrBO,MACAV,kBAAkBW,aAAa,OAAO,YACtCH,uBACA;IAEF,gDAAgD;IAChD,OAAOI,UAAUC,MAAM,GAAG,CAAC;AAC7B;AAEA,eAAe,eAAeC,UAC5BJ,IAAU;IAEV,MAAMK,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAIlB,YAAYW,MAAO;QACtD,MAAMQ,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IACEA,cAAchB,yBAAyBkB,EAAE,IACzCH,QAAQI,OAAO,EAAE,CAACd,OAAO,EACzB;YAEA;QACF;QAEA,4EAA4E;QAC5E,wEAAwE;QACxE,qDAAqD;QACrD,MAAMe,SAASL,QAAQI,OAAO,CAACC,MAAM;QACrC,MAAMC,UAAUD,QAAQE,SAASD;QACjC,MAAME,WAAWzB,kBAAkBiB,QAAQS,IAAI,EAAE;QACjD,MAAMC,UAAU,MAAMlB,eAAeC,MAAMO,QAAQS,IAAI;QAEvD,IAAI,OAAOH,YAAY,UAAU;YAC/BR,UAAUa,IAAI,CACZ,CAAC,OAAO,EAAErB,OAAO,YAAY,EAAES,YAAY,+FAA+F,CAAC;YAE7I;QACF;QACA,IAAI,CAACW,SAAS;YACZZ,UAAUa,IAAI,CACZ,CAAC,OAAO,EAAErB,OAAO,YAAY,EAAES,YAAY,sDAAsD,EAAES,SAAS,CAAC,CAAC;YAEhH;QACF;QAEAR,QAAQI,OAAO,CAACd,OAAO,GAAGF,wBAAwB;YAChDwB,UAAUP,OAAOO,QAAQ;YACzB,GAAIP,OAAOQ,SAAS,GAAG;gBAAEA,WAAW;uBAAIR,OAAOQ,SAAS;iBAAC;YAAC,IAAI,CAAC,CAAC;YAChE,6CAA6C;YAC7CN,SAAS;gBAAE,GAAGF,OAAOE,OAAO;gBAAED,SAAS,GAAGA,QAAQ,EAAE,EAAEI,QAAQ,GAAG,CAAC;YAAC;QACrE;QACA1B,2BAA2BS,MAAMM,aAAa;YAC5C,GAAGC,OAAO;YACVI,SAASf,eAAeW,QAAQI,OAAO;QACzC;IACF;IAEA,MAAMjB,qBAAqBM;IAE3B,OAAO;QAAEK;IAAU;AACrB"}

package/src/migrations/latest/gateway-agent-targets/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/gateway-agent-targets/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Bring existing workspaces up to the generators' current gateway-target\n * support, so agents can be attached to an http-protocol AgentCore Gateway:\n *\n * - The vended `AgentCoreGateway` core construct gains the `protocol` prop\n *   (http gateways have no protocol type, which AgentCore Runtime targets\n *   require) and the `addAgent` / `addAgentTarget` methods.\n * - Vended agent constructs gain the `agentName` member `addAgent` reads as\n *   the default gateway target name.\n *\n * Both files are generated with `KeepExisting`, so without this an upgraded\n * workspace pairs new app-level constructs with stale core ones.\n */\n\nconst GATEWAY_CONSTRUCT_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/agentcore-gateway/agentcore-gateway.ts`;\n\nconst AGENTS_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/agents`;\n\nconst PROTOCOL_PROP = `/**\n   * The gateway's protocol. An \\`mcp\\` gateway aggregates MCP server targets\n   * into a single MCP endpoint. An \\`http\\` gateway has no protocol type and\n   * proxies requests to AgentCore Runtime targets via path-based routing\n   * (\\`/<targetName>/invocations\\`) — the target type AgentCore only allows on\n   * gateways without a protocol type.\n   *\n   * @default 'mcp'\n   */\n  readonly protocol?: 'mcp' | 'http';`;\n\nconst PROTOCOL_CONSTRUCTOR_STATEMENTS = `this.protocol = props?.protocol ?? 'mcp';\n`;\n\nconst PROTOCOL_TYPE_REMOVAL = `\n    if (this.protocol === 'http') {\n      // AgentCore Runtime targets require a gateway without a protocol type,\n      // which the Gateway L2 cannot express — it always renders MCP — so\n      // remove the protocol from the underlying CloudFormation resource.\n      const cfnGateway = this.gateway.node.defaultChild as agentcore.CfnGateway;\n      cfnGateway.addPropertyDeletionOverride('ProtocolType');\n      cfnGateway.addPropertyDeletionOverride('ProtocolConfiguration');\n    }`;\n\nconst AGENT_TARGET_METHODS = `\n  /**\n   * Add an agent runtime construct as a target of this Gateway. Requires the\n   * \\`http\\` protocol — the gateway proxies requests for the agent under\n   * \\`<gatewayUrl>/<targetName>/invocations\\`, without protocol translation.\n   *\n   * The target name defaults to the agent construct's \\`agentName\\` (its\n   * project's class name in kebab-case, e.g. \\`MyAgent\\` -> \\`my-agent\\`). It\n   * forms the target's invocation path, so renaming it later is a breaking\n   * change for consumers.\n   */\n  public addAgent(\n    agent: Construct & {\n      readonly agentCoreRuntime: agentcore.Runtime;\n      readonly agentName: string;\n    },\n    props?: {\n      gatewayTargetName?: string;\n    },\n  ): agentcore.CfnGatewayTarget {\n    return this.addAgentTarget({\n      gatewayTargetName: props?.gatewayTargetName ?? agent.agentName,\n      agentRuntimeArn: agent.agentCoreRuntime.agentRuntimeArn,\n    });\n  }\n\n  /**\n   * Register an agent runtime ARN as a Gateway target. Prefer\n   * {@link addAgent} when the construct is in scope.\n   */\n  public addAgentTarget(props: {\n    gatewayTargetName: string;\n    agentRuntimeArn: string;\n  }): agentcore.CfnGatewayTarget {\n    if (this.protocol !== 'http') {\n      throw new Error(\n        \\`Agent runtime targets require an http-protocol gateway, but this gateway uses '\\${this.protocol}'.\\`,\n      );\n    }\n\n    // The construct id is derived from the target name so the two change\n    // together — target names are unique per gateway, and replacing a target\n    // under an unchanged name fails with AlreadyExists.\n    const target = new agentcore.CfnGatewayTarget(\n      this,\n      \\`Target-\\${props.gatewayTargetName}\\`,\n      {\n        gatewayIdentifier: this.gateway.gatewayId,\n        name: props.gatewayTargetName,\n        targetConfiguration: {\n          http: {\n            agentcoreRuntime: {\n              arn: props.agentRuntimeArn,\n              qualifier: 'DEFAULT',\n            },\n          },\n        },\n        // The bare gateway IAM role credential: runtime targets reject the\n        // iamCredentialProvider detail MCP targets carry.\n        credentialProviderConfigurations: [\n          {\n            credentialProviderType: 'GATEWAY_IAM_ROLE',\n          },\n        ],\n      },\n    );\n\n    // Grant the gateway role invoke access to the target runtime before the\n    // target is created — AgentCore validates access to the runtime during\n    // target creation.\n    const grant = this.gateway.role.addToPrincipalPolicy(\n      new iam.PolicyStatement({\n        actions: [\n          'bedrock-agentcore:InvokeAgentRuntime',\n          'bedrock-agentcore:InvokeAgentRuntimeWithWebSocketStream',\n          // A2A targets additionally serve their agent card via the gateway.\n          'bedrock-agentcore:GetAgentCard',\n        ],\n        resources: [props.agentRuntimeArn, \\`\\${props.agentRuntimeArn}/*\\`],\n      }),\n    );\n    if (grant.policyDependable) {\n      target.node.addDependency(grant.policyDependable);\n    }\n\n    return target;\n  }`;\n\n/**\n * Add the `protocol` prop, its constructor handling and the agent-target\n * methods to the vended `AgentCoreGateway` core construct.\n */\nconst migrateGatewayConstruct = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(GATEWAY_CONSTRUCT_FILE)) {\n    // No vended gateway construct in this workspace - nothing to migrate.\n    return;\n  }\n\n  if (\n    (tree.read(GATEWAY_CONSTRUCT_FILE, 'utf-8') ?? '').includes(\n      'addAgentTarget',\n    )\n  ) {\n    // Already migrated.\n    return;\n  }\n\n  const divergedMessage = `${GATEWAY_CONSTRUCT_FILE}: the AgentCoreGateway construct has diverged from the generated shape - left untouched. Re-run the agentcore-gateway generator in a fresh workspace to see the current construct, which supports agent runtime targets via a 'protocol' prop and addAgent()/addAgentTarget() methods.`;\n\n  // Anchored on the shapes every vended version of the construct carries: the\n  // props interface, the class field the protocol field is inserted after,\n  // and the Gateway creation in the constructor.\n  const hasVendedShape =\n    (await matchGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      '`export interface AgentCoreGatewayProps { $_ }`',\n    )) &&\n    (await matchGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      '`private readonly targetRuntimeArns: string[] = []`',\n    )) &&\n    (await matchGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      \"`this.gateway = new agentcore.Gateway(this, 'Gateway', $_)`\",\n    ));\n\n  if (!hasVendedShape) {\n    nextSteps.push(divergedMessage);\n    return;\n  }\n\n  // 1. The protocol prop on AgentCoreGatewayProps. The placeholder keeps the\n  //    prop's doc comment (with its backticks) out of the GritQL pattern.\n  await insertViaGritQL(\n    tree,\n    GATEWAY_CONSTRUCT_FILE,\n    `\\`export interface AgentCoreGatewayProps { $members }\\` where {\n  $members <: not contains \\`protocol\\`\n} => \\`export interface AgentCoreGatewayProps { $members\n  ${GRIT_INSERT_PLACEHOLDER}\n}\\``,\n    PROTOCOL_PROP,\n  );\n\n  // 2. The protocol class field. Matched without the trailing semicolon —\n  //    GritQL parses the snippet standalone, where the semicolon is not part\n  //    of the field's AST node.\n  await applyGritQL(\n    tree,\n    GATEWAY_CONSTRUCT_FILE,\n    `\\`private readonly targetRuntimeArns: string[] = []\\` as $field where {\n  $program <: not contains \\`private readonly protocol\\`\n} => \\`$field;\n  private readonly protocol: 'mcp' | 'http'\\``,\n  );\n\n  // 3. Assign the field and remove the protocol type for http gateways.\n  await insertViaGritQL(\n    tree,\n    GATEWAY_CONSTRUCT_FILE,\n    `\\`this.gateway = new agentcore.Gateway($args);\\` as $stmt where {\n  $program <: not contains \\`this.protocol = props\\`\n} => \\`${GRIT_INSERT_PLACEHOLDER}\n    $stmt\\``,\n    PROTOCOL_CONSTRUCTOR_STATEMENTS,\n  );\n  await insertViaGritQL(\n    tree,\n    GATEWAY_CONSTRUCT_FILE,\n    `\\`this.gateway = new agentcore.Gateway($args);\\` as $stmt where {\n  $program <: not contains \\`addPropertyDeletionOverride\\`\n} => \\`$stmt\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    PROTOCOL_TYPE_REMOVAL,\n  );\n\n  // 4. The agent-target methods, inserted after addGatewayTarget (present in\n  //    every vended version that also has the readiness probe field).\n  const addedMethods = await insertViaGritQL(\n    tree,\n    GATEWAY_CONSTRUCT_FILE,\n    `\\`public addGatewayTarget($params): agentcore.CfnGatewayTarget { $body }\\` as $method where {\n  $program <: not contains \\`addAgentTarget\\`\n} => \\`$method\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    AGENT_TARGET_METHODS,\n  );\n\n  if (!addedMethods) {\n    nextSteps.push(divergedMessage);\n    return;\n  }\n};\n\n/**\n * Add the `agentName` member to each vended agent construct, which\n * `AgentCoreGateway.addAgent` reads as the default gateway target name.\n */\nconst migrateAgentConstructs = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(AGENTS_DIR)) {\n    return;\n  }\n  for (const dir of tree.children(AGENTS_DIR)) {\n    const constructFile = `${AGENTS_DIR}/${dir}/${dir}.ts`;\n    if (!tree.exists(constructFile)) {\n      continue;\n    }\n    if ((tree.read(constructFile, 'utf-8') ?? '').includes('agentName')) {\n      // Already migrated (or user-added).\n      continue;\n    }\n    const added = await insertViaGritQL(\n      tree,\n      constructFile,\n      `\\`public readonly agentCoreRuntime: Runtime\\` as $field => \\`$field;\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n      `/** Default Gateway target name for this agent. */\n  public readonly agentName = '${dir}'`,\n    );\n    if (!added) {\n      nextSteps.push(\n        `${constructFile}: the agent construct has diverged from the generated shape - left untouched. To attach this agent to a gateway with addAgent(), add a \\`public readonly agentName = '${dir}';\\` member (or use addAgentTarget() with an explicit target name).`,\n      );\n    }\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateGatewayConstruct(tree, nextSteps);\n  await migrateAgentConstructs(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","GATEWAY_CONSTRUCT_FILE","AGENTS_DIR","PROTOCOL_PROP","PROTOCOL_CONSTRUCTOR_STATEMENTS","PROTOCOL_TYPE_REMOVAL","AGENT_TARGET_METHODS","migrateGatewayConstruct","tree","nextSteps","exists","read","includes","divergedMessage","hasVendedShape","push","addedMethods","migrateAgentConstructs","dir","children","constructFile","added","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;;;;;CAYC,GAED,MAAMC,yBAAyB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,gDAAgD,CAAC;AAEzH,MAAME,aAAa,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,eAAe,CAAC;AAE5E,MAAMG,gBAAgB,CAAC;;;;;;;;;qCASc,CAAC;AAEtC,MAAMC,kCAAkC,CAAC;AACzC,CAAC;AAED,MAAMC,wBAAwB,CAAC;;;;;;;;KAQ1B,CAAC;AAEN,MAAMC,uBAAuB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsF3B,CAAC;AAEJ;;;CAGC,GACD,MAAMC,0BAA0B,OAC9BC,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACT,yBAAyB;QACxC,sEAAsE;QACtE;IACF;IAEA,IACE,AAACO,CAAAA,KAAKG,IAAI,CAACV,wBAAwB,YAAY,EAAC,EAAGW,QAAQ,CACzD,mBAEF;QACA,oBAAoB;QACpB;IACF;IAEA,MAAMC,kBAAkB,GAAGZ,uBAAuB,sRAAsR,CAAC;IAEzU,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAMa,iBACJ,AAAC,MAAMjB,YACLW,MACAP,wBACA,sDAED,MAAMJ,YACLW,MACAP,wBACA,0DAED,MAAMJ,YACLW,MACAP,wBACA;IAGJ,IAAI,CAACa,gBAAgB;QACnBL,UAAUM,IAAI,CAACF;QACf;IACF;IAEA,2EAA2E;IAC3E,wEAAwE;IACxE,MAAMjB,gBACJY,MACAP,wBACA,CAAC;;;EAGH,EAAEN,wBAAwB;GACzB,CAAC,EACAQ;IAGF,wEAAwE;IACxE,2EAA2E;IAC3E,8BAA8B;IAC9B,MAAMT,YACJc,MACAP,wBACA,CAAC;;;6CAGwC,CAAC;IAG5C,sEAAsE;IACtE,MAAML,gBACJY,MACAP,wBACA,CAAC;;OAEE,EAAEN,wBAAwB;WACtB,CAAC,EACRS;IAEF,MAAMR,gBACJY,MACAP,wBACA,CAAC;;;AAGL,EAAEN,wBAAwB,EAAE,CAAC,EACzBU;IAGF,2EAA2E;IAC3E,oEAAoE;IACpE,MAAMW,eAAe,MAAMpB,gBACzBY,MACAP,wBACA,CAAC;;;AAGL,EAAEN,wBAAwB,EAAE,CAAC,EACzBW;IAGF,IAAI,CAACU,cAAc;QACjBP,UAAUM,IAAI,CAACF;QACf;IACF;AACF;AAEA;;;CAGC,GACD,MAAMI,yBAAyB,OAC7BT,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACR,aAAa;QAC5B;IACF;IACA,KAAK,MAAMgB,OAAOV,KAAKW,QAAQ,CAACjB,YAAa;QAC3C,MAAMkB,gBAAgB,GAAGlB,WAAW,CAAC,EAAEgB,IAAI,CAAC,EAAEA,IAAI,GAAG,CAAC;QACtD,IAAI,CAACV,KAAKE,MAAM,CAACU,gBAAgB;YAC/B;QACF;QACA,IAAI,AAACZ,CAAAA,KAAKG,IAAI,CAACS,eAAe,YAAY,EAAC,EAAGR,QAAQ,CAAC,cAAc;YAEnE;QACF;QACA,MAAMS,QAAQ,MAAMzB,gBAClBY,MACAY,eACA,CAAC;EACL,EAAEzB,wBAAwB,EAAE,CAAC,EACzB,CAAC;+BACwB,EAAEuB,IAAI,CAAC,CAAC;QAEnC,IAAI,CAACG,OAAO;YACVZ,UAAUM,IAAI,CACZ,GAAGK,cAAc,sKAAsK,EAAEF,IAAI,mEAAmE,CAAC;QAErQ;IACF;AACF;AAEA,eAAe,eAAeI,UAC5Bd,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMF,wBAAwBC,MAAMC;IACpC,MAAMQ,uBAAuBT,MAAMC;IAEnC,MAAMX,qBAAqBU;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/gateway-cognito-passthrough/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/gateway-cognito-passthrough/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Bring existing workspaces up to the generators' current gateway->agent\n * support for Cognito agents, which forward the caller's JWT to the runtime:\n *\n * - The vended `AgentCoreGateway` construct's `addAgent`/`addAgentTarget` pick\n *   the outbound credential from the agent's `auth`: a `cognito` agent uses\n *   `JWT_PASSTHROUGH` (the caller's token reaches the runtime), an `iam` agent\n *   the gateway role (`GATEWAY_IAM_ROLE`, the previous behaviour).\n * - Vended agent constructs gain an `auth` member `addAgent` reads, and Cognito\n *   agents allowlist the `Authorization` header (CDK + Terraform runtime) so the\n *   runtime receives the forwarded token.\n *\n * These files are generated with `KeepExisting`, so without this an upgraded\n * workspace pairs new app-level constructs with stale core ones. Diverged files\n * are left untouched and reported via `nextSteps`.\n */\n\nconst GATEWAY_CONSTRUCT_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/agentcore-gateway/agentcore-gateway.ts`;\nconst AGENTS_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/agents`;\nconst TF_RUNTIME_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/agent-core/runtime.tf`;\n\n/**\n * Teach the vended `AgentCoreGateway` construct to pick the target credential\n * from the agent's `auth` (JWT passthrough for Cognito, gateway role for IAM).\n */\nconst migrateGatewayConstruct = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(GATEWAY_CONSTRUCT_FILE)) {\n    return; // No vended gateway construct.\n  }\n  // Predates agent-target support (the gateway-agent-targets migration adds\n  // addAgentTarget first) — match the method, not a bare identifier.\n  if (\n    !(await matchGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      '`addAgentTarget(props: { $_ }): agentcore.CfnGatewayTarget { $_ }`',\n    ))\n  ) {\n    return;\n  }\n  // Already migrated: the credentials member is on addAgentTarget's props.\n  if (\n    await matchGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      \"`credentials?: 'gateway-iam' | 'jwt-passthrough'`\",\n    )\n  ) {\n    return;\n  }\n\n  const divergedMessage = `In ${GATEWAY_CONSTRUCT_FILE}: have addAgent read the agent's \\`auth\\` and pass \\`credentials: 'jwt-passthrough'\\` to addAgentTarget, so the target's credentialProviderType becomes 'JWT_PASSTHROUGH' for Cognito agents.`;\n\n  // GritQL patterns for each of the four edits. Verified against the tree\n  // up-front so the transform is all-or-nothing: a construct missing any\n  // anchor is left untouched with a single actionable next step, rather than\n  // half-migrated.\n  const authParamPattern = `\\`readonly agentName: string\\` as $sig where {\n  $program <: not contains \\`readonly auth?\\`\n} => \\`$sig;\n      readonly auth?: 'iam' | 'cognito'\\``;\n\n  const callPattern = `\\`agentRuntimeArn: agent.agentCoreRuntime.agentRuntimeArn\\` as $prop where {\n  $program <: not contains \\`credentials:\\`\n} => \\`$prop,\n      credentials: agent.auth === 'cognito' ? 'jwt-passthrough' : 'gateway-iam'\\``;\n\n  // The addAgentTarget props type: matched on its `agentRuntimeArn: string`\n  // member signature (without trailing semicolon), which the rewrite re-adds\n  // followed by the credentials member. The `: string` type distinguishes it\n  // from the `agentRuntimeArn:` value in the addAgent call.\n  const paramPattern = `\\`agentRuntimeArn: string\\` as $sig where {\n  $program <: not contains \\`credentials?\\`\n} => \\`$sig;\n    credentials?: 'gateway-iam' | 'jwt-passthrough'\\``;\n\n  // Scoped to the agent target's own CfnGatewayTarget (the one configured with\n  // an agentcoreRuntime), so the MCP server target's GATEWAY_IAM_ROLE — a\n  // sibling method with its own credential block — is left untouched.\n  const credentialPattern = `\\`credentialProviderType: 'GATEWAY_IAM_ROLE'\\` as $cred where {\n  $cred <: within \\`new agentcore.CfnGatewayTarget($_, $_, $config)\\`,\n  $config <: contains \\`agentcoreRuntime\\`\n} => \\`credentialProviderType:\n              props.credentials === 'jwt-passthrough'\n                ? 'JWT_PASSTHROUGH'\n                : 'GATEWAY_IAM_ROLE'\\``;\n\n  // Verify every anchor matches before mutating anything (matchGritQL is\n  // read-only), so a diverged construct is never left partially migrated.\n  for (const pattern of [\n    authParamPattern,\n    callPattern,\n    paramPattern,\n    credentialPattern,\n  ]) {\n    if (!(await matchGritQL(tree, GATEWAY_CONSTRUCT_FILE, pattern))) {\n      nextSteps.push(divergedMessage);\n      return;\n    }\n  }\n\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, authParamPattern);\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, callPattern);\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, paramPattern);\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, credentialPattern);\n};\n\n/**\n * Add the `auth` member to each vended agent construct, and for Cognito agents\n * allowlist the Authorization header so the runtime receives the forwarded JWT.\n */\nconst migrateAgentConstructs = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(AGENTS_DIR)) {\n    return;\n  }\n  for (const dir of tree.children(AGENTS_DIR)) {\n    const constructFile = `${AGENTS_DIR}/${dir}/${dir}.ts`;\n    if (!tree.exists(constructFile)) {\n      continue;\n    }\n    // Only agents (which carry a gateway target name), not MCP servers.\n    if (\n      !(await matchGritQL(\n        tree,\n        constructFile,\n        '`public readonly agentName = $_`',\n      ))\n    ) {\n      continue;\n    }\n    if (await matchGritQL(tree, constructFile, '`public readonly auth = $_`')) {\n      continue; // Already migrated (or user-added).\n    }\n\n    // Cognito agents configure the runtime's inbound authorizer with a Cognito\n    // JWT — match that authorizerConfiguration property specifically.\n    const isCognito = await matchGritQL(\n      tree,\n      constructFile,\n      '`authorizerConfiguration: RuntimeAuthorizerConfiguration.usingCognito($_)`',\n    );\n    const authValue = isCognito ? 'cognito' : 'iam';\n\n    // The `auth` member, after the agentName member. Matched without the\n    // trailing semicolon — GritQL parses the field's initializer as its AST\n    // node, so the semicolon is appended by the rewrite.\n    const authPattern = `\\`public readonly agentName = $name\\` as $field => \\`$field;\n  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */\n  public readonly auth = '${authValue}'\\``;\n\n    // Cognito agents allowlist the Authorization header so the runtime (and a\n    // fronting gateway, via passthrough) receives the caller's token.\n    const headerNeeded =\n      isCognito &&\n      !(await matchGritQL(\n        tree,\n        constructFile,\n        '`requestHeaderConfiguration: $_`',\n      ));\n    const headerPattern = `\\`authorizerConfiguration: RuntimeAuthorizerConfiguration.usingCognito($args)\\` as $authz where {\n  $program <: not contains \\`requestHeaderConfiguration\\`\n} => \\`$authz,\n      ${GRIT_INSERT_PLACEHOLDER}\\``;\n    const headerText = `// Receive the caller's Authorization header (validated by the authorizer).\n      requestHeaderConfiguration: {\n        allowlistedHeaders: ['Authorization'],\n      }`;\n\n    // Verify every anchor up-front so the construct is never half-migrated:\n    // if any edit can't be applied, leave the file untouched with one\n    // actionable next step.\n    const authOk = await matchGritQL(tree, constructFile, authPattern);\n    const headerOk =\n      !headerNeeded || (await matchGritQL(tree, constructFile, headerPattern));\n    if (!authOk || !headerOk) {\n      const actions = [\n        `add a \\`public readonly auth = '${authValue}';\\` member`,\n      ];\n      if (headerNeeded) {\n        actions.push(\n          `add \\`requestHeaderConfiguration: { allowlistedHeaders: ['Authorization'] }\\` to its Runtime so a gateway can pass the caller's JWT through`,\n        );\n      }\n      nextSteps.push(`In ${constructFile}: ${actions.join('; and ')}.`);\n      continue;\n    }\n\n    await applyGritQL(tree, constructFile, authPattern);\n    if (headerNeeded) {\n      await insertViaGritQL(tree, constructFile, headerPattern, headerText);\n    }\n  }\n};\n\n/**\n * Add the `request_header_configuration` block to the vended Terraform runtime\n * module so a JWT-authorized runtime receives the forwarded Authorization\n * header (the analogue of the CDK requestHeaderConfiguration).\n */\nconst migrateTerraformRuntime = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(TF_RUNTIME_FILE)) {\n    return;\n  }\n  if (\n    await matchGritQL(\n      tree,\n      TF_RUNTIME_FILE,\n      'language hcl\\n`dynamic \"request_header_configuration\" { $_ }`',\n    )\n  ) {\n    return; // Already migrated.\n  }\n\n  const tfActionMessage = `In ${TF_RUNTIME_FILE}: add a \\`request_header_configuration { request_header_allowlist = [\"Authorization\"] }\\` block (guarded by the JWT authorizer) to the aws_bedrockagentcore_agent_runtime resource so a gateway can pass the caller's JWT through.`;\n\n  const hasAuthorizerBlock = await matchGritQL(\n    tree,\n    TF_RUNTIME_FILE,\n    'language hcl\\n`dynamic \"authorizer_configuration\" { $_ }`',\n  );\n  if (!hasAuthorizerBlock) {\n    nextSteps.push(tfActionMessage);\n    return;\n  }\n\n  const added = await insertViaGritQL(\n    tree,\n    TF_RUNTIME_FILE,\n    `language hcl\n\\`dynamic \"authorizer_configuration\" { $body }\\` as $block where {\n  $block <: within \\`resource \"aws_bedrockagentcore_agent_runtime\" $_ { $_ }\\`\n} => \\`$block\n\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n    `# Receive the caller's Authorization header (validated by the JWT authorizer).\n  dynamic \"request_header_configuration\" {\n    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []\n    content {\n      request_header_allowlist = [\"Authorization\"]\n    }\n  }`,\n  );\n  if (!added) {\n    nextSteps.push(tfActionMessage);\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateGatewayConstruct(tree, nextSteps);\n  await migrateAgentConstructs(tree, nextSteps);\n  await migrateTerraformRuntime(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","GATEWAY_CONSTRUCT_FILE","AGENTS_DIR","TF_RUNTIME_FILE","migrateGatewayConstruct","tree","nextSteps","exists","divergedMessage","authParamPattern","callPattern","paramPattern","credentialPattern","pattern","push","migrateAgentConstructs","dir","children","constructFile","isCognito","authValue","authPattern","headerNeeded","headerPattern","headerText","authOk","headerOk","actions","join","migrateTerraformRuntime","tfActionMessage","hasAuthorizerBlock","added","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAA6C;AAEpD;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,gDAAgD,CAAC;AACzH,MAAMG,aAAa,GAAGJ,aAAa,CAAC,EAAEC,sBAAsB,eAAe,CAAC;AAC5E,MAAMI,kBAAkB,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,+BAA+B,CAAC;AAEhG;;;CAGC,GACD,MAAMI,0BAA0B,OAC9BC,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACN,yBAAyB;QACxC,QAAQ,+BAA+B;IACzC;IACA,0EAA0E;IAC1E,mEAAmE;IACnE,IACE,CAAE,MAAML,YACNS,MACAJ,wBACA,uEAEF;QACA;IACF;IACA,yEAAyE;IACzE,IACE,MAAML,YACJS,MACAJ,wBACA,sDAEF;QACA;IACF;IAEA,MAAMO,kBAAkB,CAAC,GAAG,EAAEP,uBAAuB,6LAA6L,CAAC;IAEnP,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,iBAAiB;IACjB,MAAMQ,mBAAmB,CAAC;;;yCAGa,CAAC;IAExC,MAAMC,cAAc,CAAC;;;iFAG0D,CAAC;IAEhF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAMC,eAAe,CAAC;;;qDAG6B,CAAC;IAEpD,6EAA6E;IAC7E,wEAAwE;IACxE,oEAAoE;IACpE,MAAMC,oBAAoB,CAAC;;;;;;sCAMS,CAAC;IAErC,uEAAuE;IACvE,wEAAwE;IACxE,KAAK,MAAMC,WAAW;QACpBJ;QACAC;QACAC;QACAC;KACD,CAAE;QACD,IAAI,CAAE,MAAMhB,YAAYS,MAAMJ,wBAAwBY,UAAW;YAC/DP,UAAUQ,IAAI,CAACN;YACf;QACF;IACF;IAEA,MAAMf,YAAYY,MAAMJ,wBAAwBQ;IAChD,MAAMhB,YAAYY,MAAMJ,wBAAwBS;IAChD,MAAMjB,YAAYY,MAAMJ,wBAAwBU;IAChD,MAAMlB,YAAYY,MAAMJ,wBAAwBW;AAClD;AAEA;;;CAGC,GACD,MAAMG,yBAAyB,OAC7BV,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACL,aAAa;QAC5B;IACF;IACA,KAAK,MAAMc,OAAOX,KAAKY,QAAQ,CAACf,YAAa;QAC3C,MAAMgB,gBAAgB,GAAGhB,WAAW,CAAC,EAAEc,IAAI,CAAC,EAAEA,IAAI,GAAG,CAAC;QACtD,IAAI,CAACX,KAAKE,MAAM,CAACW,gBAAgB;YAC/B;QACF;QACA,oEAAoE;QACpE,IACE,CAAE,MAAMtB,YACNS,MACAa,eACA,qCAEF;YACA;QACF;QACA,IAAI,MAAMtB,YAAYS,MAAMa,eAAe,gCAAgC;YACzE,UAAU,oCAAoC;QAChD;QAEA,2EAA2E;QAC3E,kEAAkE;QAClE,MAAMC,YAAY,MAAMvB,YACtBS,MACAa,eACA;QAEF,MAAME,YAAYD,YAAY,YAAY;QAE1C,qEAAqE;QACrE,wEAAwE;QACxE,qDAAqD;QACrD,MAAME,cAAc,CAAC;;0BAEC,EAAED,UAAU,GAAG,CAAC;QAEtC,0EAA0E;QAC1E,kEAAkE;QAClE,MAAME,eACJH,aACA,CAAE,MAAMvB,YACNS,MACAa,eACA;QAEJ,MAAMK,gBAAgB,CAAC;;;MAGrB,EAAE7B,wBAAwB,EAAE,CAAC;QAC/B,MAAM8B,aAAa,CAAC;;;OAGjB,CAAC;QAEJ,wEAAwE;QACxE,kEAAkE;QAClE,wBAAwB;QACxB,MAAMC,SAAS,MAAM7B,YAAYS,MAAMa,eAAeG;QACtD,MAAMK,WACJ,CAACJ,gBAAiB,MAAM1B,YAAYS,MAAMa,eAAeK;QAC3D,IAAI,CAACE,UAAU,CAACC,UAAU;YACxB,MAAMC,UAAU;gBACd,CAAC,gCAAgC,EAAEP,UAAU,WAAW,CAAC;aAC1D;YACD,IAAIE,cAAc;gBAChBK,QAAQb,IAAI,CACV,CAAC,2IAA2I,CAAC;YAEjJ;YACAR,UAAUQ,IAAI,CAAC,CAAC,GAAG,EAAEI,cAAc,EAAE,EAAES,QAAQC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE;QACF;QAEA,MAAMnC,YAAYY,MAAMa,eAAeG;QACvC,IAAIC,cAAc;YAChB,MAAM3B,gBAAgBU,MAAMa,eAAeK,eAAeC;QAC5D;IACF;AACF;AAEA;;;;CAIC,GACD,MAAMK,0BAA0B,OAC9BxB,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACJ,kBAAkB;QACjC;IACF;IACA,IACE,MAAMP,YACJS,MACAF,iBACA,kEAEF;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAM2B,kBAAkB,CAAC,GAAG,EAAE3B,gBAAgB,kOAAkO,CAAC;IAEjR,MAAM4B,qBAAqB,MAAMnC,YAC/BS,MACAF,iBACA;IAEF,IAAI,CAAC4B,oBAAoB;QACvBzB,UAAUQ,IAAI,CAACgB;QACf;IACF;IAEA,MAAME,QAAQ,MAAMrC,gBAClBU,MACAF,iBACA,CAAC;;;;;EAKH,EAAET,wBAAwB,EAAE,CAAC,EAC3B,CAAC;;;;;;GAMF,CAAC;IAEF,IAAI,CAACsC,OAAO;QACV1B,UAAUQ,IAAI,CAACgB;IACjB;AACF;AAEA,eAAe,eAAeG,UAC5B5B,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMF,wBAAwBC,MAAMC;IACpC,MAAMS,uBAAuBV,MAAMC;IACnC,MAAMuB,wBAAwBxB,MAAMC;IAEpC,MAAMT,qBAAqBQ;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/py-agent-lifespan-construction/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/py-agent-lifespan-construction/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { PY_AGENT_GENERATOR_INFO } from '../../../py/agent/generator';\nimport {\n  addPythonDestructuredImport,\n  applyGritQL,\n  captureGritQLVariable,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport type { ComponentMetadata } from '../../../utils/nx';\n\n/**\n * Move py#agent HTTP/AG-UI agent construction out of module import time and\n * into a FastAPI `lifespan` handler, stored on `app.state`.\n *\n * Building the agent eagerly at import time breaks any codepath that imports\n * the module before `RUNTIME_CONFIG_APP_ID`/AgentCore env vars are set (e.g.\n * OpenAPI spec generation, tests) - and, for AgentCore, construction belongs\n * at container/app startup rather than import, since AgentCore hands each\n * session its own container. The A2A protocol is unaffected: `with_session_id`\n * only touches the agent factory lazily on first use, so its eager\n * `__enter__()` was never actually eager in practice.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: every rewrite this migration makes to a file\n *   is preceded by a read-only `matchGritQL` check of every pattern it will\n *   need - so a diverged file is reported via `nextSteps` and left completely\n *   untouched, rather than partially rewritten into a broken state.\n * - Idempotent: re-running must be a no-op (each rewrite's own shape change\n *   means its pattern no longer matches on a second pass).\n * - Format what you write: finish with `formatFilesInSubtree`.\n */\n\n/** A read-only GritQL match against a python file (no rewrite). */\nconst pyMatch = (snippet: string) => `language python\\n\\`${snippet}\\``;\n\n/** A GritQL rewrite deleting the matched python snippet entirely. */\nconst pyDelete = (snippet: string) => `${pyMatch(snippet)} => .`;\n\n/**\n * A GritQL rewrite of one python snippet into another. Multi-line\n * replacements go through `raw` so GritQL's own reformatting doesn't fight\n * the exact shape being written (formatFilesInSubtree normalizes it after).\n */\nconst pyRewrite = (from: string, to: string, where?: string): string => {\n  const replacement = to.includes('\\n') ? `raw\\`${to}\\`` : `\\`${to}\\``;\n  return `${pyMatch(from)} => ${replacement}${where ? ` where { ${where} }` : ''}`;\n};\n\n/** All checks must match before anything is written for that agent. */\nconst allMatch = async (\n  tree: Tree,\n  checks: ReadonlyArray<readonly [filePath: string, pattern: string]>,\n): Promise<boolean> => {\n  for (const [filePath, pattern] of checks) {\n    if (!(await matchGritQL(tree, filePath, pattern))) return false;\n  }\n  return true;\n};\n\nconst AGENT_CONNECTION_MODULE_PATTERN = (names: string) =>\n  pyMatch(`from $mod import ${names}`);\n\nconst STRANDS_HTTP_MARKER = '_agent_ctx = with_session_id(';\nconst LANGCHAIN_HTTP_MARKER = '_graph = get_agent()';\nconst STRANDS_AGUI_MARKER = 'create_strands_app';\nconst LANGCHAIN_AGUI_MARKER = '_graph = get_agent()';\n\n// Shared by strands/http and langchain/http - only the lifespan body differs.\nconst HTTP_INIT_APP_OLD = `app = FastAPI(\n    title=\"$name\",\n    responses={500: {\"model\": InternalServerErrorDetails}},\n    generate_unique_id_function=lambda route: route.name,\n)`;\n\n// --- Strands HTTP -----------------------------------------------------------\n\nconst STRANDS_HTTP_MAIN_CTX_OLD = `_agent_ctx = with_session_id(\n    get_agent,\n    name=\"$name\",\n    description=\"A Strands Agent exposed via HTTP streaming.\",\n)`;\n\nconst STRANDS_HTTP_INIT_APP_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    with with_session_id(\n        get_agent,\n        name=\"$name\",\n        description=\"A Strands Agent exposed via HTTP streaming.\",\n    ) as agent:\n        app.state.agent = agent\n        yield\n\n\napp = FastAPI(\n    title=\"$name\",\n    responses={500: {\"model\": InternalServerErrorDetails}},\n    generate_unique_id_function=lambda route: route.name,\n    lifespan=lifespan,\n)`;\n\nconst migrateStrandsHttpAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const initPath = joinPathFragments(dir, 'init.py');\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(initPath) || !tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(STRANDS_HTTP_MARKER)) return;\n\n  const mod = await captureGritQLVariable(\n    tree,\n    mainPath,\n    AGENT_CONNECTION_MODULE_PATTERN('session_id_context, with_session_id'),\n    'mod',\n  );\n\n  const ready =\n    !!mod &&\n    (await allMatch(tree, [\n      [mainPath, pyMatch(STRANDS_HTTP_MAIN_CTX_OLD)],\n      [mainPath, pyMatch('_agent = _agent_ctx.__enter__()')],\n      [mainPath, pyMatch('from .agent import get_agent')],\n      [mainPath, pyMatch('_agent.stream_async($prompt)')],\n      [initPath, pyMatch(HTTP_INIT_APP_OLD)],\n    ]));\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched, along with ${initPath}. Manually move agent construction into an \\`init.py\\` \\`lifespan\\` handler storing the agent on \\`app.state.agent\\` (see the py#agent generator's strands/http template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    initPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n  await addPythonDestructuredImport(tree, initPath, ['get_agent'], '.agent');\n  await addPythonDestructuredImport(tree, initPath, ['with_session_id'], mod);\n  await applyGritQL(\n    tree,\n    initPath,\n    pyRewrite(HTTP_INIT_APP_OLD, STRANDS_HTTP_INIT_APP_NEW),\n  );\n\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      'from $mod import session_id_context, with_session_id',\n      'from $mod import session_id_context',\n    ),\n  );\n  await applyGritQL(tree, mainPath, pyDelete('from .agent import get_agent'));\n  await applyGritQL(tree, mainPath, pyDelete(STRANDS_HTTP_MAIN_CTX_OLD));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyDelete('_agent = _agent_ctx.__enter__()'),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      '_agent.stream_async($prompt)',\n      'app.state.agent.stream_async($prompt)',\n    ),\n  );\n};\n\n// --- LangChain HTTP ----------------------------------------------------------\n\nconst LANGCHAIN_HTTP_INIT_APP_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    app.state.graph = get_agent()\n    yield\n\n\napp = FastAPI(\n    title=\"$name\",\n    responses={500: {\"model\": InternalServerErrorDetails}},\n    generate_unique_id_function=lambda route: route.name,\n    lifespan=lifespan,\n)`;\n\nconst migrateLangchainHttpAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const initPath = joinPathFragments(dir, 'init.py');\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(initPath) || !tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(LANGCHAIN_HTTP_MARKER)) return;\n\n  const ready = await allMatch(tree, [\n    [mainPath, pyMatch('_graph = get_agent()')],\n    [mainPath, pyMatch('from .agent import get_agent')],\n    [mainPath, pyMatch('_graph.astream($args)')],\n    [initPath, pyMatch(HTTP_INIT_APP_OLD)],\n  ]);\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched, along with ${initPath}. Manually wrap \\`get_agent()\\` in an \\`init.py\\` \\`lifespan\\` handler storing the graph on \\`app.state.graph\\` (see the py#agent generator's langchain/http template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    initPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n  await addPythonDestructuredImport(tree, initPath, ['get_agent'], '.agent');\n  await applyGritQL(\n    tree,\n    initPath,\n    pyRewrite(HTTP_INIT_APP_OLD, LANGCHAIN_HTTP_INIT_APP_NEW),\n  );\n\n  await applyGritQL(tree, mainPath, pyDelete('from .agent import get_agent'));\n  await applyGritQL(tree, mainPath, pyDelete('_graph = get_agent()'));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite('_graph.astream($args)', 'app.state.graph.astream($args)'),\n  );\n};\n\n// --- LangChain AG-UI ---------------------------------------------------------\n\nconst LANGCHAIN_AGUI_AGENT_OLD = `agui_agent = LangGraphAgent(\n    name=\"$name\",\n    graph=_graph,\n    description=\"A LangChain/LangGraph Agent exposed via the AG-UI protocol.\",\n)`;\n\nconst LANGCHAIN_AGUI_AGENT_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    graph = get_agent()\n    app.state.agui_agent = LangGraphAgent(\n        name=\"$name\",\n        graph=graph,\n        description=\"A LangChain/LangGraph Agent exposed via the AG-UI protocol.\",\n    )\n    yield`;\n\nconst migrateLangchainAgUiAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(LANGCHAIN_AGUI_MARKER)) return;\n\n  const ready = await allMatch(tree, [\n    [mainPath, pyMatch('_graph = get_agent()')],\n    [mainPath, pyMatch(LANGCHAIN_AGUI_AGENT_OLD)],\n    [mainPath, pyMatch('agui_agent.run($input)')],\n    [mainPath, pyMatch('app = FastAPI(title=\"$name\")')],\n  ]);\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched. Manually wrap graph + \\`LangGraphAgent\\` construction in a \\`lifespan\\` handler storing the wrapper on \\`app.state.agui_agent\\` (see the py#agent generator's langchain/ag-ui template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n\n  await applyGritQL(tree, mainPath, pyDelete('_graph = get_agent()'));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(LANGCHAIN_AGUI_AGENT_OLD, LANGCHAIN_AGUI_AGENT_NEW),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      'agui_agent.run($input)',\n      'request.app.state.agui_agent.run($input)',\n    ),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      'app = FastAPI(title=\"$name\")',\n      'app = FastAPI(title=\"$name\", lifespan=lifespan)',\n    ),\n  );\n};\n\n// --- Strands AG-UI -----------------------------------------------------------\n// The biggest of the four: `ag_ui_strands.create_strands_app` is dropped\n// entirely for an inlined FastAPI app (matching upstream `ag_ui_strands`,\n// plus a Content-Type-independent body-parsing fix and an explicit session\n// re-bind `create_strands_app` was missing), so most of the file is new.\n\nconst STRANDS_AGUI_IMPORT_OLD =\n  'from ag_ui_strands import StrandsAgent, create_strands_app';\n\nconst STRANDS_AGUI_AGENT_OLD = `agui_agent = StrandsAgent(\n    agent=_agent,\n    name=\"$name\",\n    description=\"A Strands Agent exposed via the AG-UI protocol.\",\n)`;\n\nconst STRANDS_AGUI_AGENT_NEW = `@asynccontextmanager\nasync def lifespan(app: FastAPI):\n    with get_agent() as agent:\n        app.state.agui_agent = StrandsAgent(\n            agent=agent,\n            name=\"$name\",\n            description=\"A Strands Agent exposed via the AG-UI protocol.\",\n        )\n        yield`;\n\nconst STRANDS_AGUI_APP_OLD =\n  'app = create_strands_app(agui_agent, path=\"/invocations\")';\n\n// `$name` isn't bound within this match (unlike STRANDS_AGUI_AGENT_OLD above),\n// so the title is built from a name captured separately rather than reused as\n// a metavariable - GritQL leaves a rewrite whose replacement references an\n// unbound metavariable unapplied.\nconst strandsAguiAppNew = (\n  name: string,\n) => `app = FastAPI(title=\"AWS Strands - ${name}\", lifespan=lifespan)\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=[\"*\"],\n    allow_credentials=True,\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)`;\n\nconst STRANDS_AGUI_MIDDLEWARE_OLD = 'app.add_middleware(_SessionIdMiddleware)';\n\nconst STRANDS_AGUI_ROUTES_NEW = `app.add_middleware(_SessionIdMiddleware)\n\n\n@app.post(\"/invocations\")\nasync def invocations(request: Request):\n    # Validate the body manually since AgentCore may omit Content-Type.\n    encoder = EventEncoder(accept=request.headers.get(\"accept\") or \"\")\n    raw = await request.body()\n    try:\n        input_data = RunAgentInput.model_validate_json(raw)\n    except Exception as exc:\n        message = f\"Invalid RunAgentInput: {str(exc)[:200]}\"\n\n        async def _bad():\n            yield encoder.encode(RunErrorEvent(type=EventType.RUN_ERROR, message=message, code=\"BAD_REQUEST\"))\n\n        return StreamingResponse(_bad(), media_type=encoder.get_content_type())\n\n    session_id = request.headers.get(SESSION_ID_HEADER) or get_current_session_id()\n\n    async def event_generator():\n        # Re-bind the session: the streaming body runs outside the middleware.\n        with session_id_context(session_id or str(uuid.uuid4())):\n            async for event in request.app.state.agui_agent.run(input_data):\n                try:\n                    yield encoder.encode(event)\n                except Exception as e:\n                    error_event = RunErrorEvent(\n                        type=EventType.RUN_ERROR,\n                        message=f\"Encoding error: {e}\",\n                        code=\"ENCODING_ERROR\",\n                    )\n                    yield encoder.encode(error_event)\n                    break\n\n    return StreamingResponse(event_generator(), media_type=encoder.get_content_type())\n\n\n@app.get(\"/ping\")\nasync def ping():\n    return {\"status\": \"healthy\"}`;\n\nconst STRANDS_AGUI_COMMENTS_OLD = [\n  '# Create AG-UI agent wrapper',\n  '# Create FastAPI app with AG-UI endpoint and health check',\n];\n\nconst migrateStrandsAgUiAgent = async (\n  tree: Tree,\n  dir: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const mainPath = joinPathFragments(dir, 'main.py');\n  if (!tree.exists(mainPath)) return;\n\n  const mainContents = tree.read(mainPath, 'utf-8') ?? '';\n  if (!mainContents.includes(STRANDS_AGUI_MARKER)) return;\n\n  const mod = await captureGritQLVariable(\n    tree,\n    mainPath,\n    AGENT_CONNECTION_MODULE_PATTERN('session_id_context'),\n    'mod',\n  );\n  const agentClassName = await captureGritQLVariable(\n    tree,\n    mainPath,\n    pyMatch(STRANDS_AGUI_AGENT_OLD),\n    'name',\n  );\n\n  const ready =\n    !!mod &&\n    !!agentClassName &&\n    (await allMatch(tree, [\n      [mainPath, pyMatch(STRANDS_AGUI_IMPORT_OLD)],\n      [mainPath, pyMatch('_agent_ctx = get_agent()')],\n      [mainPath, pyMatch('_agent = _agent_ctx.__enter__()')],\n      [mainPath, pyMatch(STRANDS_AGUI_AGENT_OLD)],\n      [mainPath, pyMatch(STRANDS_AGUI_APP_OLD)],\n      [mainPath, pyMatch(STRANDS_AGUI_MIDDLEWARE_OLD)],\n    ]));\n\n  if (!ready) {\n    nextSteps.push(\n      `${mainPath}: diverged from the generated shape - left untouched. Manually rebuild this file without \\`create_strands_app\\`: a \\`lifespan\\` handler storing the wrapper on \\`app.state.agui_agent\\`, and inlined \\`/invocations\\`/\\`/ping\\` routes with Content-Type-independent body parsing (see the py#agent generator's strands/ag-ui template).`,\n    );\n    return;\n  }\n\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['asynccontextmanager'],\n    'contextlib',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['EventType', 'RunAgentInput', 'RunErrorEvent'],\n    'ag_ui.core',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['EventEncoder'],\n    'ag_ui.encoder',\n  );\n  await addPythonDestructuredImport(tree, mainPath, ['FastAPI'], 'fastapi');\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['CORSMiddleware'],\n    'fastapi.middleware.cors',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['StreamingResponse'],\n    'fastapi.responses',\n  );\n  await addPythonDestructuredImport(\n    tree,\n    mainPath,\n    ['get_current_session_id'],\n    mod,\n  );\n\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(\n      STRANDS_AGUI_IMPORT_OLD,\n      'from ag_ui_strands import StrandsAgent',\n    ),\n  );\n  await applyGritQL(tree, mainPath, pyDelete('_agent_ctx = get_agent()'));\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyDelete('_agent = _agent_ctx.__enter__()'),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(STRANDS_AGUI_AGENT_OLD, STRANDS_AGUI_AGENT_NEW),\n  );\n  for (const comment of STRANDS_AGUI_COMMENTS_OLD) {\n    await applyGritQL(tree, mainPath, pyDelete(comment));\n  }\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(STRANDS_AGUI_APP_OLD, strandsAguiAppNew(agentClassName)),\n  );\n  await applyGritQL(\n    tree,\n    mainPath,\n    pyRewrite(STRANDS_AGUI_MIDDLEWARE_OLD, STRANDS_AGUI_ROUTES_NEW),\n  );\n};\n\n/** This agent's ComponentMetadata entries. */\nconst findAgentComponents = (\n  components: ComponentMetadata[] | undefined,\n): ComponentMetadata[] =>\n  (components ?? []).filter(\n    (component) => component.generator === PY_AGENT_GENERATOR_INFO.id,\n  );\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const project of getProjects(tree).values()) {\n    const components = findAgentComponents(\n      (project.metadata as { components?: ComponentMetadata[] })?.components,\n    );\n\n    for (const component of components) {\n      if (!component.path) continue;\n      const dir = joinPathFragments(project.root, component.path);\n      const framework = component.framework ?? 'strands';\n\n      if (component.protocol === 'http') {\n        if (framework === 'langchain') {\n          await migrateLangchainHttpAgent(tree, dir, nextSteps);\n        } else {\n          await migrateStrandsHttpAgent(tree, dir, nextSteps);\n        }\n      } else if (component.protocol === 'ag-ui') {\n        if (framework === 'langchain') {\n          await migrateLangchainAgUiAgent(tree, dir, nextSteps);\n        } else {\n          await migrateStrandsAgUiAgent(tree, dir, nextSteps);\n        }\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","PY_AGENT_GENERATOR_INFO","addPythonDestructuredImport","applyGritQL","captureGritQLVariable","matchGritQL","formatFilesInSubtree","pyMatch","snippet","pyDelete","pyRewrite","from","to","where","replacement","includes","allMatch","tree","checks","filePath","pattern","AGENT_CONNECTION_MODULE_PATTERN","names","STRANDS_HTTP_MARKER","LANGCHAIN_HTTP_MARKER","STRANDS_AGUI_MARKER","LANGCHAIN_AGUI_MARKER","HTTP_INIT_APP_OLD","STRANDS_HTTP_MAIN_CTX_OLD","STRANDS_HTTP_INIT_APP_NEW","migrateStrandsHttpAgent","dir","nextSteps","initPath","mainPath","exists","mainContents","read","mod","ready","push","LANGCHAIN_HTTP_INIT_APP_NEW","migrateLangchainHttpAgent","LANGCHAIN_AGUI_AGENT_OLD","LANGCHAIN_AGUI_AGENT_NEW","migrateLangchainAgUiAgent","STRANDS_AGUI_IMPORT_OLD","STRANDS_AGUI_AGENT_OLD","STRANDS_AGUI_AGENT_NEW","STRANDS_AGUI_APP_OLD","strandsAguiAppNew","name","STRANDS_AGUI_MIDDLEWARE_OLD","STRANDS_AGUI_ROUTES_NEW","STRANDS_AGUI_COMMENTS_OLD","migrateStrandsAgUiAgent","agentClassName","comment","findAgentComponents","components","filter","component","generator","id","migration","project","values","metadata","path","root","framework","protocol"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,uBAAuB,QAAQ,iCAA8B;AACtE,SACEC,2BAA2B,EAC3BC,WAAW,EACXC,qBAAqB,EACrBC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAG7D;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,iEAAiE,GACjE,MAAMC,UAAU,CAACC,UAAoB,CAAC,mBAAmB,EAAEA,QAAQ,EAAE,CAAC;AAEtE,mEAAmE,GACnE,MAAMC,WAAW,CAACD,UAAoB,GAAGD,QAAQC,SAAS,KAAK,CAAC;AAEhE;;;;CAIC,GACD,MAAME,YAAY,CAACC,MAAcC,IAAYC;IAC3C,MAAMC,cAAcF,GAAGG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAEH,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAEA,GAAG,EAAE,CAAC;IACpE,OAAO,GAAGL,QAAQI,MAAM,IAAI,EAAEG,cAAcD,QAAQ,CAAC,SAAS,EAAEA,MAAM,EAAE,CAAC,GAAG,IAAI;AAClF;AAEA,qEAAqE,GACrE,MAAMG,WAAW,OACfC,MACAC;IAEA,KAAK,MAAM,CAACC,UAAUC,QAAQ,IAAIF,OAAQ;QACxC,IAAI,CAAE,MAAMb,YAAYY,MAAME,UAAUC,UAAW,OAAO;IAC5D;IACA,OAAO;AACT;AAEA,MAAMC,kCAAkC,CAACC,QACvCf,QAAQ,CAAC,iBAAiB,EAAEe,OAAO;AAErC,MAAMC,sBAAsB;AAC5B,MAAMC,wBAAwB;AAC9B,MAAMC,sBAAsB;AAC5B,MAAMC,wBAAwB;AAE9B,8EAA8E;AAC9E,MAAMC,oBAAoB,CAAC;;;;CAI1B,CAAC;AAEF,+EAA+E;AAE/E,MAAMC,4BAA4B,CAAC;;;;CAIlC,CAAC;AAEF,MAAMC,4BAA4B,CAAC;;;;;;;;;;;;;;;;CAgBlC,CAAC;AAEF,MAAMC,0BAA0B,OAC9Bb,MACAc,KACAC;IAEA,MAAMC,WAAWjC,kBAAkB+B,KAAK;IACxC,MAAMG,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACF,aAAa,CAAChB,KAAKkB,MAAM,CAACD,WAAW;IAEtD,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACQ,sBAAsB;IAEjD,MAAMe,MAAM,MAAMlC,sBAChBa,MACAiB,UACAb,gCAAgC,wCAChC;IAGF,MAAMkB,QACJ,CAAC,CAACD,OACD,MAAMtB,SAASC,MAAM;QACpB;YAACiB;YAAU3B,QAAQqB;SAA2B;QAC9C;YAACM;YAAU3B,QAAQ;SAAmC;QACtD;YAAC2B;YAAU3B,QAAQ;SAAgC;QACnD;YAAC2B;YAAU3B,QAAQ;SAAgC;QACnD;YAAC0B;YAAU1B,QAAQoB;SAAmB;KACvC;IAEH,IAAI,CAACY,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,iEAAiE,EAAED,SAAS,0KAA0K,CAAC;QAErQ;IACF;IAEA,MAAM/B,4BACJe,MACAgB,UACA;QAAC;KAAsB,EACvB;IAEF,MAAM/B,4BAA4Be,MAAMgB,UAAU;QAAC;KAAY,EAAE;IACjE,MAAM/B,4BAA4Be,MAAMgB,UAAU;QAAC;KAAkB,EAAEK;IACvE,MAAMnC,YACJc,MACAgB,UACAvB,UAAUiB,mBAAmBE;IAG/B,MAAM1B,YACJc,MACAiB,UACAxB,UACE,wDACA;IAGJ,MAAMP,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YAAYc,MAAMiB,UAAUzB,SAASmB;IAC3C,MAAMzB,YACJc,MACAiB,UACAzB,SAAS;IAEX,MAAMN,YACJc,MACAiB,UACAxB,UACE,gCACA;AAGN;AAEA,gFAAgF;AAEhF,MAAM+B,8BAA8B,CAAC;;;;;;;;;;;CAWpC,CAAC;AAEF,MAAMC,4BAA4B,OAChCzB,MACAc,KACAC;IAEA,MAAMC,WAAWjC,kBAAkB+B,KAAK;IACxC,MAAMG,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACF,aAAa,CAAChB,KAAKkB,MAAM,CAACD,WAAW;IAEtD,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACS,wBAAwB;IAEnD,MAAMe,QAAQ,MAAMvB,SAASC,MAAM;QACjC;YAACiB;YAAU3B,QAAQ;SAAwB;QAC3C;YAAC2B;YAAU3B,QAAQ;SAAgC;QACnD;YAAC2B;YAAU3B,QAAQ;SAAyB;QAC5C;YAAC0B;YAAU1B,QAAQoB;SAAmB;KACvC;IAED,IAAI,CAACY,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,iEAAiE,EAAED,SAAS,uKAAuK,CAAC;QAElQ;IACF;IAEA,MAAM/B,4BACJe,MACAgB,UACA;QAAC;KAAsB,EACvB;IAEF,MAAM/B,4BAA4Be,MAAMgB,UAAU;QAAC;KAAY,EAAE;IACjE,MAAM9B,YACJc,MACAgB,UACAvB,UAAUiB,mBAAmBc;IAG/B,MAAMtC,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YACJc,MACAiB,UACAxB,UAAU,yBAAyB;AAEvC;AAEA,gFAAgF;AAEhF,MAAMiC,2BAA2B,CAAC;;;;CAIjC,CAAC;AAEF,MAAMC,2BAA2B,CAAC;;;;;;;;SAQzB,CAAC;AAEV,MAAMC,4BAA4B,OAChC5B,MACAc,KACAC;IAEA,MAAME,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACD,WAAW;IAE5B,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACW,wBAAwB;IAEnD,MAAMa,QAAQ,MAAMvB,SAASC,MAAM;QACjC;YAACiB;YAAU3B,QAAQ;SAAwB;QAC3C;YAAC2B;YAAU3B,QAAQoC;SAA0B;QAC7C;YAACT;YAAU3B,QAAQ;SAA0B;QAC7C;YAAC2B;YAAU3B,QAAQ;SAAgC;KACpD;IAED,IAAI,CAACgC,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,8OAA8O,CAAC;QAE7P;IACF;IAEA,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAsB,EACvB;IAGF,MAAM/B,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YACJc,MACAiB,UACAxB,UAAUiC,0BAA0BC;IAEtC,MAAMzC,YACJc,MACAiB,UACAxB,UACE,0BACA;IAGJ,MAAMP,YACJc,MACAiB,UACAxB,UACE,gCACA;AAGN;AAEA,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AAEzE,MAAMoC,0BACJ;AAEF,MAAMC,yBAAyB,CAAC;;;;CAI/B,CAAC;AAEF,MAAMC,yBAAyB,CAAC;;;;;;;;aAQnB,CAAC;AAEd,MAAMC,uBACJ;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,kCAAkC;AAClC,MAAMC,oBAAoB,CACxBC,OACG,CAAC,mCAAmC,EAAEA,KAAK;;;;;;;CAO/C,CAAC;AAEF,MAAMC,8BAA8B;AAEpC,MAAMC,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAwCD,CAAC;AAEjC,MAAMC,4BAA4B;IAChC;IACA;CACD;AAED,MAAMC,0BAA0B,OAC9BtC,MACAc,KACAC;IAEA,MAAME,WAAWlC,kBAAkB+B,KAAK;IACxC,IAAI,CAACd,KAAKkB,MAAM,CAACD,WAAW;IAE5B,MAAME,eAAenB,KAAKoB,IAAI,CAACH,UAAU,YAAY;IACrD,IAAI,CAACE,aAAarB,QAAQ,CAACU,sBAAsB;IAEjD,MAAMa,MAAM,MAAMlC,sBAChBa,MACAiB,UACAb,gCAAgC,uBAChC;IAEF,MAAMmC,iBAAiB,MAAMpD,sBAC3Ba,MACAiB,UACA3B,QAAQwC,yBACR;IAGF,MAAMR,QACJ,CAAC,CAACD,OACF,CAAC,CAACkB,kBACD,MAAMxC,SAASC,MAAM;QACpB;YAACiB;YAAU3B,QAAQuC;SAAyB;QAC5C;YAACZ;YAAU3B,QAAQ;SAA4B;QAC/C;YAAC2B;YAAU3B,QAAQ;SAAmC;QACtD;YAAC2B;YAAU3B,QAAQwC;SAAwB;QAC3C;YAACb;YAAU3B,QAAQ0C;SAAsB;QACzC;YAACf;YAAU3B,QAAQ6C;SAA6B;KACjD;IAEH,IAAI,CAACb,OAAO;QACVP,UAAUQ,IAAI,CACZ,GAAGN,SAAS,wUAAwU,CAAC;QAEvV;IACF;IAEA,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAsB,EACvB;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;QAAa;QAAiB;KAAgB,EAC/C;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAe,EAChB;IAEF,MAAMhC,4BAA4Be,MAAMiB,UAAU;QAAC;KAAU,EAAE;IAC/D,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAiB,EAClB;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAoB,EACrB;IAEF,MAAMhC,4BACJe,MACAiB,UACA;QAAC;KAAyB,EAC1BI;IAGF,MAAMnC,YACJc,MACAiB,UACAxB,UACEoC,yBACA;IAGJ,MAAM3C,YAAYc,MAAMiB,UAAUzB,SAAS;IAC3C,MAAMN,YACJc,MACAiB,UACAzB,SAAS;IAEX,MAAMN,YACJc,MACAiB,UACAxB,UAAUqC,wBAAwBC;IAEpC,KAAK,MAAMS,WAAWH,0BAA2B;QAC/C,MAAMnD,YAAYc,MAAMiB,UAAUzB,SAASgD;IAC7C;IACA,MAAMtD,YACJc,MACAiB,UACAxB,UAAUuC,sBAAsBC,kBAAkBM;IAEpD,MAAMrD,YACJc,MACAiB,UACAxB,UAAU0C,6BAA6BC;AAE3C;AAEA,4CAA4C,GAC5C,MAAMK,sBAAsB,CAC1BC,aAEA,AAACA,CAAAA,cAAc,EAAE,AAAD,EAAGC,MAAM,CACvB,CAACC,YAAcA,UAAUC,SAAS,KAAK7D,wBAAwB8D,EAAE;AAGrE,eAAe,eAAeC,UAC5B/C,IAAU;IAEV,MAAMe,YAAsB,EAAE;IAE9B,KAAK,MAAMiC,WAAWlE,YAAYkB,MAAMiD,MAAM,GAAI;QAChD,MAAMP,aAAaD,oBAChBO,QAAQE,QAAQ,EAA2CR;QAG9D,KAAK,MAAME,aAAaF,WAAY;YAClC,IAAI,CAACE,UAAUO,IAAI,EAAE;YACrB,MAAMrC,MAAM/B,kBAAkBiE,QAAQI,IAAI,EAAER,UAAUO,IAAI;YAC1D,MAAME,YAAYT,UAAUS,SAAS,IAAI;YAEzC,IAAIT,UAAUU,QAAQ,KAAK,QAAQ;gBACjC,IAAID,cAAc,aAAa;oBAC7B,MAAM5B,0BAA0BzB,MAAMc,KAAKC;gBAC7C,OAAO;oBACL,MAAMF,wBAAwBb,MAAMc,KAAKC;gBAC3C;YACF,OAAO,IAAI6B,UAAUU,QAAQ,KAAK,SAAS;gBACzC,IAAID,cAAc,aAAa;oBAC7B,MAAMzB,0BAA0B5B,MAAMc,KAAKC;gBAC7C,OAAO;oBACL,MAAMuB,wBAAwBtC,MAAMc,KAAKC;gBAC3C;YACF;QACF;IACF;IAEA,MAAM1B,qBAAqBW;IAE3B,OAAO;QAAEe;IAAU;AACrB"}

package/src/migrations/latest/rename-load-runtime-config-target/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rename-load-runtime-config-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  type MigrationReturnObject,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\n\n/**\n * React website projects gained a `load-runtime-config` target so the config\n * can be loaded with the verb syntax (`nx load-runtime-config <project>`),\n * replacing the colon-separated `load:runtime-config` that had to be quoted on\n * the CLI. This clones the existing target under the new name in workspaces\n * generated before the rename, leaving the original in place so any scripts\n * still referencing it keep working.\n */\n\nconst OLD_TARGET = 'load:runtime-config';\nconst NEW_TARGET = 'load-runtime-config';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  for (const [projectName, project] of getProjects(tree)) {\n    const targets = project.targets;\n    if (!targets?.[OLD_TARGET] || targets[NEW_TARGET]) {\n      // No target to clone, or the new target already exists.\n      continue;\n    }\n\n    const cloned = structuredClone(targets[OLD_TARGET]);\n    // Point the description at the verb syntax for the new target.\n    if (cloned.metadata?.description) {\n      cloned.metadata.description = cloned.metadata.description.replace(\n        new RegExp(`nx run (\\\\S+):${OLD_TARGET}`, 'g'),\n        `nx ${NEW_TARGET} $1`,\n      );\n    }\n    targets[NEW_TARGET] = cloned;\n\n    updateProjectConfiguration(tree, projectName, project);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","updateProjectConfiguration","formatFilesInSubtree","OLD_TARGET","NEW_TARGET","migration","tree","projectName","project","targets","cloned","structuredClone","metadata","description","replace","RegExp"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EAGXC,0BAA0B,QACrB,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAE7D;;;;;;;CAOC,GAED,MAAMC,aAAa;AACnB,MAAMC,aAAa;AAEnB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,KAAK,MAAM,CAACC,aAAaC,QAAQ,IAAIR,YAAYM,MAAO;QACtD,MAAMG,UAAUD,QAAQC,OAAO;QAC/B,IAAI,CAACA,SAAS,CAACN,WAAW,IAAIM,OAAO,CAACL,WAAW,EAAE;YAEjD;QACF;QAEA,MAAMM,SAASC,gBAAgBF,OAAO,CAACN,WAAW;QAClD,+DAA+D;QAC/D,IAAIO,OAAOE,QAAQ,EAAEC,aAAa;YAChCH,OAAOE,QAAQ,CAACC,WAAW,GAAGH,OAAOE,QAAQ,CAACC,WAAW,CAACC,OAAO,CAC/D,IAAIC,OAAO,CAAC,cAAc,EAAEZ,YAAY,EAAE,MAC1C,CAAC,GAAG,EAAEC,WAAW,GAAG,CAAC;QAEzB;QACAK,OAAO,CAACL,WAAW,GAAGM;QAEtBT,2BAA2BK,MAAMC,aAAaC;IAChD;IAEA,MAAMN,qBAAqBI;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/rolldown-code-splitting/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rolldown-code-splitting/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\n\n/**\n * Move generated rolldown configs onto `codeSplitting: false`.\n *\n * rolldown deprecated the `inlineDynamicImports` output option in favour of\n * `codeSplitting`, and warns once per bundle entry — so a workspace with several\n * bundled projects printed the warning many times over on every build. Both\n * spellings ask for the same thing: the whole bundle in a single file, which is\n * what the vended Lambda and container bundles need.\n *\n * Guardrails:\n * - Both patterns are anchored to a rolldown `output` object and scoped with\n *   `some` to its direct properties, so an object of the user's own that happens\n *   to carry the same key is left alone. `inlineDynamicImports: false` is also\n *   left alone: it means the opposite, so a user who set it deliberately keeps it.\n * - Where an output already carries `codeSplitting`, the deprecated option is\n *   dropped rather than renamed, so the rewrite can't produce a duplicate key.\n * - Idempotent: neither pattern matches once the option is gone.\n */\n\n/**\n * Rename the deprecated option, where the output does not already set\n * `codeSplitting`.\n */\nconst RENAME_PATTERN = `\\`output: { $props }\\` where {\n  $props <: some \\`inlineDynamicImports: true\\` as $deprecated,\n  $props <: not some \\`codeSplitting: $_\\`,\n  $deprecated => \\`codeSplitting: false\\`\n}`;\n\n/**\n * Drop the deprecated option where `codeSplitting` is already set — renaming it\n * would leave the output with the key twice.\n */\nconst DROP_PATTERN = `\\`output: { $props }\\` where {\n  $props <: some \\`codeSplitting: $_\\`,\n  $props <: some \\`inlineDynamicImports: true\\` as $deprecated,\n  $deprecated => .\n}`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  for (const project of getProjects(tree).values()) {\n    const configPath = joinPathFragments(project.root, 'rolldown.config.ts');\n    if (!tree.exists(configPath)) {\n      continue;\n    }\n    for (const pattern of [RENAME_PATTERN, DROP_PATTERN]) {\n      await applyGritQL(tree, configPath, pattern);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","joinPathFragments","applyGritQL","formatFilesInSubtree","RENAME_PATTERN","DROP_PATTERN","migration","tree","project","values","configPath","root","exists","pattern"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,oBAAoB,QAAQ,2BAAwB;AAE7D;;;;;;;;;;;;;;;;;CAiBC,GAED;;;CAGC,GACD,MAAMC,iBAAiB,CAAC;;;;CAIvB,CAAC;AAEF;;;CAGC,GACD,MAAMC,eAAe,CAAC;;;;CAIrB,CAAC;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,KAAK,MAAMC,WAAWR,YAAYO,MAAME,MAAM,GAAI;QAChD,MAAMC,aAAaT,kBAAkBO,QAAQG,IAAI,EAAE;QACnD,IAAI,CAACJ,KAAKK,MAAM,CAACF,aAAa;YAC5B;QACF;QACA,KAAK,MAAMG,WAAW;YAACT;YAAgBC;SAAa,CAAE;YACpD,MAAMH,YAAYK,MAAMG,YAAYG;QACtC;IACF;IAEA,MAAMV,qBAAqBI;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/smithy-build-without-docker/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/smithy-build-without-docker/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport {\n  DEPENDENCIES,\n  SMITHY_PROJECT_GENERATOR_INFO,\n  type SmithyProjectMetadata,\n  smithyCompileCommands,\n  smithyCompileOutputs,\n  smithyGenerateSsdkTarget,\n  writeSsdkBundleConfig,\n} from '../../../smithy/project/generator';\nimport { addTsDependencies } from '../../../utils/add-dependencies';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { FsCommands } from '../../../utils/fs';\nimport { warnIfSmithyMissing } from '../../../utils/smithy';\n\n/**\n * Move Smithy projects off the container build onto the Smithy CLI.\n *\n * A Smithy build used to run inside an image: the `build.Dockerfile` installed the\n * CLI, built the model, and — for a service — installed and bundled the generated\n * Server SDK. That made Docker a prerequisite for any workspace holding a Smithy\n * project. The CLI now runs on the machine, so the Dockerfile goes and the\n * `compile` target is rewritten to invoke it.\n *\n * The target's commands are replaced wholesale rather than patched: every one of\n * them changes, and they are generated configuration. A project whose commands the\n * user has edited is left alone and reported, since replacing them would discard\n * those edits.\n */\n\n/** Where a consuming project's Dockerfile brought in a shape library's model. */\nconst WORKSPACE_CONTEXT_COPY = /COPY\\s+--from=workspace\\s+(\\S+)\\s+\\S+/g;\n\n/**\n * The metadata a Smithy model project records, as a workspace on an older release\n * may hold it — `smithyType` predates neither the generator nor this migration, so\n * it may be absent.\n */\ninterface SmithyMetadata extends Partial<SmithyProjectMetadata> {\n  readonly generator?: string;\n}\n\nconst smithyMetadata = (\n  project: ProjectConfiguration,\n): SmithyMetadata | undefined => project.metadata as SmithyMetadata | undefined;\n\n/**\n * Whether a project's `compile` commands are the ones a previous release\n * generated, so replacing them discards nothing.\n *\n * Matched on the shape of the image build rather than the exact string: the engine\n * is `docker` or `finch` depending on the workspace's configuration, and the\n * commands around it moved between releases.\n */\nconst hasGeneratedDockerCompile = (project: ProjectConfiguration): boolean => {\n  const commands: unknown = project.targets?.compile?.options?.commands;\n  if (!Array.isArray(commands)) {\n    return false;\n  }\n  const imageBuilds = commands.filter(\n    (command): command is string =>\n      typeof command === 'string' && command.includes('build.Dockerfile'),\n  );\n  // Exactly the one image build the generator wrote, in the form it wrote it.\n  // Anything else means the user has been in here.\n  return (\n    imageBuilds.length === 1 &&\n    /^(?:docker|finch) build /.test(imageBuilds[0]) &&\n    imageBuilds[0].includes('--target export')\n  );\n};\n\n/**\n * The shape libraries a Dockerfile copied in, as `imports` entries.\n *\n * Consuming a shape library used to need a `COPY --from=workspace` bringing its\n * built model into the image, and an `imports` entry pointing at where it landed.\n * With the build on the machine, `imports` reaches the built model directly — the\n * CLI resolves them relative to `smithy-build.json` — so each copy becomes a\n * relative path, and the Dockerfile is no longer needed to carry it.\n */\nconst importsFromDockerfileCopies = (\n  dockerfile: string,\n  projectRoot: string,\n): string[] => {\n  const upToRoot = projectRoot\n    .split('/')\n    .filter(Boolean)\n    .map(() => '..')\n    .join('/');\n  return [...dockerfile.matchAll(WORKSPACE_CONTEXT_COPY)].map(\n    ([, source]) => `${upToRoot}/${source}`,\n  );\n};\n\n/** Add the imports a Dockerfile's copies stood for, keeping the user's own. */\nconst addImports = (tree: Tree, projectRoot: string, imports: string[]) => {\n  if (imports.length === 0) {\n    return;\n  }\n  const path = joinPathFragments(projectRoot, 'smithy-build.json');\n  if (!tree.exists(path)) {\n    return;\n  }\n  const smithyBuild = JSON.parse(tree.read(path, 'utf-8') ?? '{}');\n  const existing: string[] = smithyBuild.imports ?? [];\n  smithyBuild.imports = [\n    ...existing,\n    ...imports.filter((entry) => !existing.includes(entry)),\n  ];\n  tree.write(path, JSON.stringify(smithyBuild, null, 2));\n};\n\nconst editedNextStep = (projectName: string): string =>\n  `${projectName}: its compile target has been customised, so it was left as it is. Smithy projects now build with the Smithy CLI rather than a container — see https://awslabs.github.io/nx-plugin-for-aws/guides/smithy-project/ for the target it expects.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n  const migrated: SmithyProjectMetadata[] = [];\n\n  for (const [name, project] of getProjects(tree)) {\n    const metadata = smithyMetadata(project);\n    if (metadata?.generator !== SMITHY_PROJECT_GENERATOR_INFO.id) {\n      continue;\n    }\n\n    const dockerfilePath = joinPathFragments(project.root, 'build.Dockerfile');\n    if (!tree.exists(dockerfilePath)) {\n      continue;\n    }\n\n    if (!hasGeneratedDockerCompile(project)) {\n      nextSteps.push(editedNextStep(name));\n      continue;\n    }\n\n    // A project generated before the type was recorded is a service: the shapes\n    // type shipped with the metadata already in place.\n    const type = metadata.smithyType ?? 'service';\n\n    // Carry over the shape library dependencies the Dockerfile expressed as\n    // build-context copies before dropping it.\n    addImports(\n      tree,\n      project.root,\n      importsFromDockerfileCopies(\n        tree.read(dockerfilePath, 'utf-8') ?? '',\n        project.root,\n      ),\n    );\n    tree.delete(dockerfilePath);\n\n    // Built from the same helpers the generator uses, so the targets a migrated\n    // project gets cannot drift from a freshly generated one.\n    const cmd = new FsCommands(tree, DEPENDENCIES);\n    project.targets ??= {};\n    project.targets.compile = {\n      ...project.targets.compile,\n      outputs: smithyCompileOutputs(type),\n      options: {\n        ...project.targets.compile?.options,\n        commands: smithyCompileCommands(cmd, type),\n      },\n    };\n\n    // A service's Server SDK moves to its own target, so the model build and the\n    // SDK build cache separately.\n    if (type === 'service') {\n      project.targets['generate-ssdk'] = {\n        ...project.targets['generate-ssdk'],\n        ...smithyGenerateSsdkTarget(),\n      };\n      project.targets.build = {\n        ...project.targets.build,\n        dependsOn: ['compile', 'generate-ssdk'],\n      };\n    }\n    updateProjectConfiguration(tree, name, project);\n\n    if (type === 'service') {\n      writeSsdkBundleConfig(tree, project.root);\n    }\n    migrated.push({ smithyType: type, namespace: metadata.namespace ?? '' });\n  }\n\n  // A service's SDK bundler, which the image used to carry. The Smithy CLI needs\n  // nothing here — the target fetches mise with `npx`.\n  //\n  // Added per migrated project rather than once for the workspace, so a mix of\n  // services and shape libraries gets the union of what each needs. All of these\n  // go to the root manifest, so repeating one is a no-op.\n  for (const metadata of migrated) {\n    addTsDependencies(tree, DEPENDENCIES, { metadata });\n  }\n\n  // On Windows the migrated build runs the Smithy CLI from the PATH rather than\n  // through mise, so flag a missing prerequisite when a project was moved across.\n  if (migrated.length > 0) {\n    warnIfSmithyMissing();\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","DEPENDENCIES","SMITHY_PROJECT_GENERATOR_INFO","smithyCompileCommands","smithyCompileOutputs","smithyGenerateSsdkTarget","writeSsdkBundleConfig","addTsDependencies","formatFilesInSubtree","FsCommands","warnIfSmithyMissing","WORKSPACE_CONTEXT_COPY","smithyMetadata","project","metadata","hasGeneratedDockerCompile","commands","targets","compile","options","Array","isArray","imageBuilds","filter","command","includes","length","test","importsFromDockerfileCopies","dockerfile","projectRoot","upToRoot","split","Boolean","map","join","matchAll","source","addImports","tree","imports","path","exists","smithyBuild","JSON","parse","read","existing","entry","write","stringify","editedNextStep","projectName","migration","nextSteps","migrated","name","generator","id","dockerfilePath","root","push","type","smithyType","delete","cmd","outputs","build","dependsOn","namespace"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SACEC,YAAY,EACZC,6BAA6B,EAE7BC,qBAAqB,EACrBC,oBAAoB,EACpBC,wBAAwB,EACxBC,qBAAqB,QAChB,uCAAoC;AAC3C,SAASC,iBAAiB,QAAQ,qCAAkC;AACpE,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,UAAU,QAAQ,uBAAoB;AAC/C,SAASC,mBAAmB,QAAQ,2BAAwB;AAE5D;;;;;;;;;;;;;CAaC,GAED,+EAA+E,GAC/E,MAAMC,yBAAyB;AAW/B,MAAMC,iBAAiB,CACrBC,UAC+BA,QAAQC,QAAQ;AAEjD;;;;;;;CAOC,GACD,MAAMC,4BAA4B,CAACF;IACjC,MAAMG,WAAoBH,QAAQI,OAAO,EAAEC,SAASC,SAASH;IAC7D,IAAI,CAACI,MAAMC,OAAO,CAACL,WAAW;QAC5B,OAAO;IACT;IACA,MAAMM,cAAcN,SAASO,MAAM,CACjC,CAACC,UACC,OAAOA,YAAY,YAAYA,QAAQC,QAAQ,CAAC;IAEpD,4EAA4E;IAC5E,iDAAiD;IACjD,OACEH,YAAYI,MAAM,KAAK,KACvB,2BAA2BC,IAAI,CAACL,WAAW,CAAC,EAAE,KAC9CA,WAAW,CAAC,EAAE,CAACG,QAAQ,CAAC;AAE5B;AAEA;;;;;;;;CAQC,GACD,MAAMG,8BAA8B,CAClCC,YACAC;IAEA,MAAMC,WAAWD,YACdE,KAAK,CAAC,KACNT,MAAM,CAACU,SACPC,GAAG,CAAC,IAAM,MACVC,IAAI,CAAC;IACR,OAAO;WAAIN,WAAWO,QAAQ,CAACzB;KAAwB,CAACuB,GAAG,CACzD,CAAC,GAAGG,OAAO,GAAK,GAAGN,SAAS,CAAC,EAAEM,QAAQ;AAE3C;AAEA,6EAA6E,GAC7E,MAAMC,aAAa,CAACC,MAAYT,aAAqBU;IACnD,IAAIA,QAAQd,MAAM,KAAK,GAAG;QACxB;IACF;IACA,MAAMe,OAAO1C,kBAAkB+B,aAAa;IAC5C,IAAI,CAACS,KAAKG,MAAM,CAACD,OAAO;QACtB;IACF;IACA,MAAME,cAAcC,KAAKC,KAAK,CAACN,KAAKO,IAAI,CAACL,MAAM,YAAY;IAC3D,MAAMM,WAAqBJ,YAAYH,OAAO,IAAI,EAAE;IACpDG,YAAYH,OAAO,GAAG;WACjBO;WACAP,QAAQjB,MAAM,CAAC,CAACyB,QAAU,CAACD,SAAStB,QAAQ,CAACuB;KACjD;IACDT,KAAKU,KAAK,CAACR,MAAMG,KAAKM,SAAS,CAACP,aAAa,MAAM;AACrD;AAEA,MAAMQ,iBAAiB,CAACC,cACtB,GAAGA,YAAY,4OAA4O,CAAC;AAE9P,eAAe,eAAeC,UAC5Bd,IAAU;IAEV,MAAMe,YAAsB,EAAE;IAC9B,MAAMC,WAAoC,EAAE;IAE5C,KAAK,MAAM,CAACC,MAAM3C,QAAQ,IAAIf,YAAYyC,MAAO;QAC/C,MAAMzB,WAAWF,eAAeC;QAChC,IAAIC,UAAU2C,cAAcvD,8BAA8BwD,EAAE,EAAE;YAC5D;QACF;QAEA,MAAMC,iBAAiB5D,kBAAkBc,QAAQ+C,IAAI,EAAE;QACvD,IAAI,CAACrB,KAAKG,MAAM,CAACiB,iBAAiB;YAChC;QACF;QAEA,IAAI,CAAC5C,0BAA0BF,UAAU;YACvCyC,UAAUO,IAAI,CAACV,eAAeK;YAC9B;QACF;QAEA,4EAA4E;QAC5E,mDAAmD;QACnD,MAAMM,OAAOhD,SAASiD,UAAU,IAAI;QAEpC,wEAAwE;QACxE,2CAA2C;QAC3CzB,WACEC,MACA1B,QAAQ+C,IAAI,EACZhC,4BACEW,KAAKO,IAAI,CAACa,gBAAgB,YAAY,IACtC9C,QAAQ+C,IAAI;QAGhBrB,KAAKyB,MAAM,CAACL;QAEZ,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAMM,MAAM,IAAIxD,WAAW8B,MAAMtC;QACjCY,QAAQI,OAAO,KAAK,CAAC;QACrBJ,QAAQI,OAAO,CAACC,OAAO,GAAG;YACxB,GAAGL,QAAQI,OAAO,CAACC,OAAO;YAC1BgD,SAAS9D,qBAAqB0D;YAC9B3C,SAAS;gBACP,GAAGN,QAAQI,OAAO,CAACC,OAAO,EAAEC,OAAO;gBACnCH,UAAUb,sBAAsB8D,KAAKH;YACvC;QACF;QAEA,6EAA6E;QAC7E,8BAA8B;QAC9B,IAAIA,SAAS,WAAW;YACtBjD,QAAQI,OAAO,CAAC,gBAAgB,GAAG;gBACjC,GAAGJ,QAAQI,OAAO,CAAC,gBAAgB;gBACnC,GAAGZ,0BAA0B;YAC/B;YACAQ,QAAQI,OAAO,CAACkD,KAAK,GAAG;gBACtB,GAAGtD,QAAQI,OAAO,CAACkD,KAAK;gBACxBC,WAAW;oBAAC;oBAAW;iBAAgB;YACzC;QACF;QACApE,2BAA2BuC,MAAMiB,MAAM3C;QAEvC,IAAIiD,SAAS,WAAW;YACtBxD,sBAAsBiC,MAAM1B,QAAQ+C,IAAI;QAC1C;QACAL,SAASM,IAAI,CAAC;YAAEE,YAAYD;YAAMO,WAAWvD,SAASuD,SAAS,IAAI;QAAG;IACxE;IAEA,+EAA+E;IAC/E,qDAAqD;IACrD,EAAE;IACF,6EAA6E;IAC7E,+EAA+E;IAC/E,wDAAwD;IACxD,KAAK,MAAMvD,YAAYyC,SAAU;QAC/BhD,kBAAkBgC,MAAMtC,cAAc;YAAEa;QAAS;IACnD;IAEA,8EAA8E;IAC9E,gFAAgF;IAChF,IAAIyC,SAAS7B,MAAM,GAAG,GAAG;QACvBhB;IACF;IAEA,MAAMF,qBAAqB+B;IAE3B,OAAO;QAAEe;IAAU;AACrB"}

package/src/migrations/latest/smithy-ssdk-bundle-pins/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/smithy-ssdk-bundle-pins/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { SMITHY_PROJECT_GENERATOR_INFO } from '../../../smithy/project/generator';\nimport { applyGritQL } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { isVendedUpgrade } from '../../../utils/version-upgrade-migration/vended-upgrade';\n\n/**\n * Move a Smithy `build.Dockerfile` onto the SSDK bundle pins this release fixes.\n *\n * `rolldown-plugin-dts` named the bundled declaration after its content hash\n * before 0.20.0, so the generated handler's `./generated/ssdk/index.js` import\n * found no `index.d.ts` beside it and `compile` failed with TS7016. The two pins\n * move together: the plugin release that fixed the naming needs a rolldown past\n * the pin this shipped with.\n *\n * There is no Dockerfile grammar, so each pin is matched as an anchored rewrite\n * over the whole file with the version captured — `${...}` in these patterns is\n * GritQL metavariable syntax, not interpolation.\n */\n\n/** A pin in the file body, and the version this migration moves it to. */\ninterface Pin {\n  /** The package as the install command names it. */\n  readonly name: string;\n  readonly target: string;\n}\n\n/**\n * Hardcoded rather than read from `TS_VERSIONS`: this runs once, for the release\n * that fixed the declaration naming, so it must keep applying that exact change\n * however far the vended versions move afterwards. A workspace on a later release\n * gets the newer pins from the version sync instead.\n */\nconst PINS: readonly Pin[] = [\n  { name: 'rolldown', target: '1.2.0' },\n  { name: 'rolldown-plugin-dts', target: '0.28.0' },\n  { name: '@rollup/plugin-esm-shim', target: '0.1.8' },\n];\n\n/** A version ends at whitespace, a line break or the end of the command. */\nconst VERSION = String.raw`[^\\s\\\\]+`;\n\nconst escapeRegExp = (value: string): string =>\n  value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n/**\n * Rewrite every occurrence of one pin to its target version.\n *\n * The pin is matched by name, so a `rolldown-plugin-dts@x` in the same command as\n * `rolldown@y` keeps its own version — the `@` before the version terminates the\n * match, so the shorter name does not match the longer one.\n */\nconst rewritePin = ({ name, target }: Pin): string =>\n  `r\"[\\\\s\\\\S]*${escapeRegExp(name)}@(${VERSION})[\\\\s\\\\S]*\"($version) where { $version => \\`${target}\\` }`;\n\n/** Whether the file pins this package behind the target version. */\nconst isBehindTarget = (contents: string, { name, target }: Pin): boolean => {\n  const matches = contents.matchAll(\n    new RegExp(`${escapeRegExp(name)}@(${VERSION})`, 'g'),\n  );\n  const declared = [...matches].flatMap((match) =>\n    match[1] ? [match[1]] : [],\n  );\n  // A rewrite replaces every occurrence at once, so this has to hold for all of\n  // them. Compared rather than tested for inequality, so a workspace a later\n  // release has already moved past the target keeps its newer pin.\n  return (\n    declared.length > 0 &&\n    declared.every((version) => isVendedUpgrade(target, version))\n  );\n};\n\nconst divergedNextStep = (path: string): string =>\n  `${path}: the Smithy build image's bundle pins have diverged from the generated shape - left untouched. Update \\`rolldown\\` to 1.2.0 and \\`rolldown-plugin-dts\\` to 0.28.0.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  // Only a Smithy service project bundles the SSDK; the shapes type builds the\n  // model alone and pins none of this.\n  const buildDockerfiles = [...getProjects(tree).values()]\n    .filter((project) => {\n      const metadata = project.metadata as\n        | { generator?: string; smithyType?: string }\n        | undefined;\n      return (\n        metadata?.generator === SMITHY_PROJECT_GENERATOR_INFO.id &&\n        metadata.smithyType === 'service'\n      );\n    })\n    .map((project) => joinPathFragments(project.root, 'build.Dockerfile'))\n    .filter((filePath) => tree.exists(filePath));\n\n  for (const path of buildDockerfiles) {\n    const contents = tree.read(path, 'utf-8') ?? '';\n\n    for (const pin of PINS) {\n      if (!isBehindTarget(contents, pin)) {\n        continue;\n      }\n      if (!(await applyGritQL(tree, path, rewritePin(pin)))) {\n        nextSteps.push(divergedNextStep(path));\n        break;\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","SMITHY_PROJECT_GENERATOR_INFO","applyGritQL","formatFilesInSubtree","isVendedUpgrade","PINS","name","target","VERSION","String","raw","escapeRegExp","value","replace","rewritePin","isBehindTarget","contents","matches","matchAll","RegExp","declared","flatMap","match","length","every","version","divergedNextStep","path","migration","tree","nextSteps","buildDockerfiles","values","filter","project","metadata","generator","id","smithyType","map","root","filePath","exists","read","pin","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,6BAA6B,QAAQ,uCAAoC;AAClF,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,eAAe,QAAQ,6DAA0D;AAuB1F;;;;;CAKC,GACD,MAAMC,OAAuB;IAC3B;QAAEC,MAAM;QAAYC,QAAQ;IAAQ;IACpC;QAAED,MAAM;QAAuBC,QAAQ;IAAS;IAChD;QAAED,MAAM;QAA2BC,QAAQ;IAAQ;CACpD;AAED,0EAA0E,GAC1E,MAAMC,UAAUC,OAAOC,GAAG,CAAC,QAAQ,CAAC;AAEpC,MAAMC,eAAe,CAACC,QACpBA,MAAMC,OAAO,CAAC,uBAAuB;AAEvC;;;;;;CAMC,GACD,MAAMC,aAAa,CAAC,EAAER,IAAI,EAAEC,MAAM,EAAO,GACvC,CAAC,WAAW,EAAEI,aAAaL,MAAM,EAAE,EAAEE,QAAQ,4CAA4C,EAAED,OAAO,IAAI,CAAC;AAEzG,kEAAkE,GAClE,MAAMQ,iBAAiB,CAACC,UAAkB,EAAEV,IAAI,EAAEC,MAAM,EAAO;IAC7D,MAAMU,UAAUD,SAASE,QAAQ,CAC/B,IAAIC,OAAO,GAAGR,aAAaL,MAAM,EAAE,EAAEE,QAAQ,CAAC,CAAC,EAAE;IAEnD,MAAMY,WAAW;WAAIH;KAAQ,CAACI,OAAO,CAAC,CAACC,QACrCA,KAAK,CAAC,EAAE,GAAG;YAACA,KAAK,CAAC,EAAE;SAAC,GAAG,EAAE;IAE5B,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,OACEF,SAASG,MAAM,GAAG,KAClBH,SAASI,KAAK,CAAC,CAACC,UAAYrB,gBAAgBG,QAAQkB;AAExD;AAEA,MAAMC,mBAAmB,CAACC,OACxB,GAAGA,KAAK,mKAAmK,CAAC;AAE9K,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,6EAA6E;IAC7E,qCAAqC;IACrC,MAAMC,mBAAmB;WAAIhC,YAAY8B,MAAMG,MAAM;KAAG,CACrDC,MAAM,CAAC,CAACC;QACP,MAAMC,WAAWD,QAAQC,QAAQ;QAGjC,OACEA,UAAUC,cAAcnC,8BAA8BoC,EAAE,IACxDF,SAASG,UAAU,KAAK;IAE5B,GACCC,GAAG,CAAC,CAACL,UAAYlC,kBAAkBkC,QAAQM,IAAI,EAAE,qBACjDP,MAAM,CAAC,CAACQ,WAAaZ,KAAKa,MAAM,CAACD;IAEpC,KAAK,MAAMd,QAAQI,iBAAkB;QACnC,MAAMf,WAAWa,KAAKc,IAAI,CAAChB,MAAM,YAAY;QAE7C,KAAK,MAAMiB,OAAOvC,KAAM;YACtB,IAAI,CAACU,eAAeC,UAAU4B,MAAM;gBAClC;YACF;YACA,IAAI,CAAE,MAAM1C,YAAY2B,MAAMF,MAAMb,WAAW8B,OAAQ;gBACrDd,UAAUe,IAAI,CAACnB,iBAAiBC;gBAChC;YACF;QACF;IACF;IAEA,MAAMxB,qBAAqB0B;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/strip-pip-from-python-images/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/strip-pip-from-python-images/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport type { ComponentMetadata } from '../../../utils/nx';\n\n/**\n * Remove pip from the vended Python agent / MCP server images.\n *\n * The runtime runs entirely from the bundled `/app` environment and never needs\n * pip, whose vendored packages (setuptools, msgpack) in the base image carry\n * known HIGH/CRITICAL vulnerabilities the image scan flags. New workspaces get\n * this from the generator templates; this brings existing ones up to date.\n *\n * Only the Dockerfiles of `py#agent` / `py#mcp-server` components are touched,\n * located from their project metadata. The Dockerfile is generated\n * `KeepExisting`, so it is edited in place: the pip removal is inserted right\n * after the `FROM` line. A Dockerfile whose pip usage has been customised (an\n * added `pip install`, or any pip command other than this removal) is left\n * untouched and reported via `nextSteps`, since stripping pip could break it.\n */\n\n/**\n * The generators whose runtime images vend pip and should have it stripped.\n * Hardcoded rather than imported from the generators: a migration matches the\n * ids workspaces recorded at generation time, which must stay fixed even if the\n * generators' current ids change later.\n */\nconst RUNTIME_IMAGE_GENERATOR_IDS = ['py#agent', 'py#mcp-server'];\n\nconst PIP_REMOVAL = `# Remove the base image's pip: the runtime runs from the bundled environment and\n# never needs it, and pip's vendored packages carry known HIGH/CRITICAL\n# vulnerabilities flagged by the image scan.\nRUN python -m pip uninstall -y pip && \\\\\n    rm -rf /usr/local/lib/python*/site-packages/pip \\\\\n           /usr/local/lib/python*/site-packages/pip-*.dist-info`;\n\n/** The exact pip command this migration adds; used to detect an applied fix. */\nconst PIP_UNINSTALL = 'pip uninstall -y pip';\n\n/** Matches any `pip` invocation in a RUN instruction (python -m pip … or pip …). */\nconst PIP_COMMAND = /\\b(?:python\\s+-m\\s+)?pip\\s+\\S+/g;\n\n/**\n * The Dockerfiles of every `py#agent` / `py#mcp-server` component, located from\n * each project's recorded component metadata (`path` is the component directory\n * relative to the project root).\n */\nconst runtimeImageDockerfiles = (tree: Tree): string[] => {\n  const paths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components = ((\n      project.metadata as { components?: ComponentMetadata[] }\n    )?.components ?? []) as ComponentMetadata[];\n    for (const component of components) {\n      if (\n        !RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) ||\n        !component.path\n      ) {\n        continue;\n      }\n      const dockerfile = joinPathFragments(\n        projectRoot(project),\n        component.path,\n        'Dockerfile',\n      );\n      if (tree.exists(dockerfile)) {\n        paths.push(dockerfile);\n      }\n    }\n  }\n  return paths;\n};\n\n/** A project's root, falling back to sourceRoot for the TS-solution layout. */\nconst projectRoot = (project: ProjectConfiguration): string =>\n  project.root ?? project.sourceRoot ?? '';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of runtimeImageDockerfiles(tree)) {\n    const content = tree.read(filePath, 'utf-8');\n    if (!content) {\n      continue;\n    }\n    if (content.includes(PIP_UNINSTALL)) {\n      continue; // Already stripped (migrated or user-added).\n    }\n\n    // Leave a customised Dockerfile alone: any pip usage other than this\n    // migration's removal (e.g. an added `pip install`) means stripping pip\n    // could break the image, so flag it for the user instead of editing.\n    const pipUsages = content.match(PIP_COMMAND) ?? [];\n    if (pipUsages.length > 0) {\n      nextSteps.push(\n        `In ${filePath}: this image uses pip (${pipUsages.join(', ')}), so it was left unchanged. pip's vendored packages carry known vulnerabilities flagged by the image scan — remove pip once it is no longer needed, e.g. \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\`.`,\n      );\n      continue;\n    }\n\n    // Insert the pip removal after the FROM line and its trailing blank line,\n    // matching the spacing a freshly generated Dockerfile has.\n    const updated = content.replace(\n      /^(FROM\\s+\\S*python:.*\\n)\\n/m,\n      `$1\\n${PIP_REMOVAL}\\n\\n`,\n    );\n    if (updated === content) {\n      nextSteps.push(\n        `In ${filePath}: remove pip from the image so its vulnerable vendored packages are not scanned — add \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\` after the FROM line (the runtime does not need pip).`,\n      );\n      continue;\n    }\n    tree.write(filePath, updated);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","RUNTIME_IMAGE_GENERATOR_IDS","PIP_REMOVAL","PIP_UNINSTALL","PIP_COMMAND","runtimeImageDockerfiles","tree","paths","project","values","components","metadata","component","includes","generator","path","dockerfile","projectRoot","exists","push","root","sourceRoot","migration","nextSteps","filePath","content","read","pipUsages","match","length","join","updated","replace","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAG7D;;;;;;;;;;;;;;CAcC,GAED;;;;;CAKC,GACD,MAAMC,8BAA8B;IAAC;IAAY;CAAgB;AAEjE,MAAMC,cAAc,CAAC;;;;;+DAK0C,CAAC;AAEhE,8EAA8E,GAC9E,MAAMC,gBAAgB;AAEtB,kFAAkF,GAClF,MAAMC,cAAc;AAEpB;;;;CAIC,GACD,MAAMC,0BAA0B,CAACC;IAC/B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWV,YAAYQ,MAAMG,MAAM,GAAI;QAChD,MAAMC,aAAc,AAClBF,QAAQG,QAAQ,EACfD,cAAc,EAAE;QACnB,KAAK,MAAME,aAAaF,WAAY;YAClC,IACE,CAACT,4BAA4BY,QAAQ,CAACD,UAAUE,SAAS,KACzD,CAACF,UAAUG,IAAI,EACf;gBACA;YACF;YACA,MAAMC,aAAajB,kBACjBkB,YAAYT,UACZI,UAAUG,IAAI,EACd;YAEF,IAAIT,KAAKY,MAAM,CAACF,aAAa;gBAC3BT,MAAMY,IAAI,CAACH;YACb;QACF;IACF;IACA,OAAOT;AACT;AAEA,6EAA6E,GAC7E,MAAMU,cAAc,CAACT,UACnBA,QAAQY,IAAI,IAAIZ,QAAQa,UAAU,IAAI;AAExC,eAAe,eAAeC,UAC5BhB,IAAU;IAEV,MAAMiB,YAAsB,EAAE;IAE9B,KAAK,MAAMC,YAAYnB,wBAAwBC,MAAO;QACpD,MAAMmB,UAAUnB,KAAKoB,IAAI,CAACF,UAAU;QACpC,IAAI,CAACC,SAAS;YACZ;QACF;QACA,IAAIA,QAAQZ,QAAQ,CAACV,gBAAgB;YACnC,UAAU,6CAA6C;QACzD;QAEA,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,MAAMwB,YAAYF,QAAQG,KAAK,CAACxB,gBAAgB,EAAE;QAClD,IAAIuB,UAAUE,MAAM,GAAG,GAAG;YACxBN,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,uBAAuB,EAAEG,UAAUG,IAAI,CAAC,MAAM,ySAAyS,CAAC;YAEzW;QACF;QAEA,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAMC,UAAUN,QAAQO,OAAO,CAC7B,+BACA,CAAC,IAAI,EAAE9B,YAAY,IAAI,CAAC;QAE1B,IAAI6B,YAAYN,SAAS;YACvBF,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,yRAAyR,CAAC;YAE3S;QACF;QACAlB,KAAK2B,KAAK,CAACT,UAAUO;IACvB;IAEA,MAAM/B,qBAAqBM;IAE3B,OAAO;QAAEiB;IAAU;AACrB"}

package/src/migrations/latest/vite-config-import-meta-dirname/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/vite-config-import-meta-dirname/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\n\n/**\n * Resolve the vended vite and vitest config paths from `import.meta.dirname`\n * rather than `__dirname`.\n *\n * `__dirname` is unavailable to Vite's native config loader, so every generated\n * TypeScript project's config warned that it \"uses features that are unsupported\n * by `configLoader: 'native'`\". That loader is slated to become the default, at\n * which point the config breaks rather than warns.\n *\n * Two shapes are rewritten: the `root` that `@nx/js` writes into every project's\n * config, and the two paths `ts#react-website` passes to the TanStack Router\n * plugin.\n *\n * Guardrails:\n * - Every pattern is anchored to the exact shape the generators produce, and\n *   scoped with `some` so it only matches a direct property of the object it\n *   names. A `root` nested inside another option, or a `resolve(__dirname, ...)`\n *   the user wrote anywhere else in the config, is left alone.\n * - The router paths are matched by option name *and* path literal, so a user who\n *   pointed one somewhere else keeps their value.\n * - Idempotent: no pattern matches once rewritten.\n */\n\n/**\n * The `root` of the object the config factory returns. `some` matches a direct\n * property only, so a nested `root` (a `test.alias` entry, say) is not touched.\n */\nconst ROOT_PATTERN = `\\`defineConfig(() => ({ $props }))\\` where {\n  $props <: some \\`root: __dirname\\` as $root,\n  $root => \\`root: import.meta.dirname\\`\n}`;\n\n/**\n * One of the TanStack Router plugin's path options, matched by name and by the\n * path the generator passes — so a user who repointed it keeps their value.\n * Scoped to the plugin's own option object rather than the file, so a\n * `resolve(__dirname, ...)` elsewhere in the config is left alone.\n */\nconst routerPathPattern = (option: string, path: string): string =>\n  `\\`tanstackRouter({ $opts })\\` where {\n     $opts <: some \\`${option}: resolve(__dirname, '${path}')\\` as $path,\n     $path => \\`${option}: resolve(import.meta.dirname, '${path}')\\`\n   }`;\n\n/** The paths `ts#react-website` gives the TanStack Router plugin. */\nconst ROUTER_PATTERNS = [\n  routerPathPattern('routesDirectory', 'src/routes'),\n  routerPathPattern('generatedRouteTree', 'src/routeTree.gen.ts'),\n];\n\n/** The config filenames a generated project may carry. */\nconst CONFIG_FILES = ['vitest.config.mts', 'vite.config.mts'];\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  for (const project of getProjects(tree).values()) {\n    for (const configFile of CONFIG_FILES) {\n      const configPath = joinPathFragments(project.root, configFile);\n      if (!tree.exists(configPath)) {\n        continue;\n      }\n      for (const pattern of [ROOT_PATTERN, ...ROUTER_PATTERNS]) {\n        await applyGritQL(tree, configPath, pattern);\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","joinPathFragments","applyGritQL","formatFilesInSubtree","ROOT_PATTERN","routerPathPattern","option","path","ROUTER_PATTERNS","CONFIG_FILES","migration","tree","project","values","configFile","configPath","root","exists","pattern"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,oBAAoB,QAAQ,2BAAwB;AAE7D;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED;;;CAGC,GACD,MAAMC,eAAe,CAAC;;;CAGrB,CAAC;AAEF;;;;;CAKC,GACD,MAAMC,oBAAoB,CAACC,QAAgBC,OACzC,CAAC;qBACkB,EAAED,OAAO,sBAAsB,EAAEC,KAAK;gBAC3C,EAAED,OAAO,gCAAgC,EAAEC,KAAK;IAC5D,CAAC;AAEL,mEAAmE,GACnE,MAAMC,kBAAkB;IACtBH,kBAAkB,mBAAmB;IACrCA,kBAAkB,sBAAsB;CACzC;AAED,wDAAwD,GACxD,MAAMI,eAAe;IAAC;IAAqB;CAAkB;AAE7D,eAAe,eAAeC,UAC5BC,IAAU;IAEV,KAAK,MAAMC,WAAWZ,YAAYW,MAAME,MAAM,GAAI;QAChD,KAAK,MAAMC,cAAcL,aAAc;YACrC,MAAMM,aAAad,kBAAkBW,QAAQI,IAAI,EAAEF;YACnD,IAAI,CAACH,KAAKM,MAAM,CAACF,aAAa;gBAC5B;YACF;YACA,KAAK,MAAMG,WAAW;gBAACd;mBAAiBI;aAAgB,CAAE;gBACxD,MAAMN,YAAYS,MAAMI,YAAYG;YACtC;QACF;IACF;IAEA,MAAMf,qBAAqBQ;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/latest/waf-log-group-removal/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/waf-log-group-removal/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Vended WAF log groups have a deterministic name (WAFv2 requires the\n * `aws-waf-logs-` prefix, so the name can't be CloudFormation-generated) and,\n * without an explicit removal policy, inherit CloudFormation's default RETAIN\n * for log groups. A rolled-back or replaced deploy then orphans the log group,\n * so the next deploy fails to create one of the same name. Set\n * `RemovalPolicy.DESTROY` so it is torn down with the stack, matching the\n * vended user-identity (Cognito) construct.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\n\n/**\n * A vended construct carrying a WAF log group. They differ in how the log\n * group is constructed and how `cdk` is imported: the gateway namespaces both\n * (`logs.LogGroup`, `cdk.RemovalPolicy`), the rest api destructures both\n * (`LogGroup`, `RemovalPolicy` — the latter added by this migration when\n * absent).\n */\ninterface WafConstruct {\n  file: string;\n  /** How `LogGroup` is referenced in this file (`LogGroup` or `logs.LogGroup`). */\n  logGroupExpr: string;\n  /** The removal policy expression, matching the file's import style. */\n  removalPolicyExpr: string;\n  /** When set, ensure this destructured import from `aws-cdk-lib`. */\n  destructuredImport?: string;\n}\n\nconst WAF_CONSTRUCTS: WafConstruct[] = [\n  {\n    file: `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`,\n    logGroupExpr: 'logs.LogGroup',\n    removalPolicyExpr: 'cdk.RemovalPolicy.DESTROY',\n  },\n  {\n    file: `${CONSTRUCTS_SRC}/core/api/rest-api.ts`,\n    logGroupExpr: 'LogGroup',\n    removalPolicyExpr: 'RemovalPolicy.DESTROY',\n    destructuredImport: 'RemovalPolicy',\n  },\n];\n\nconst migrateConstruct = async (\n  tree: Tree,\n  construct: WafConstruct,\n  nextSteps: string[],\n): Promise<void> => {\n  const { file, logGroupExpr } = construct;\n  if (!tree.exists(file)) {\n    // Construct not vended in this workspace - nothing to migrate.\n    return;\n  }\n\n  const contents = tree.read(file, 'utf-8') ?? '';\n\n  // The WAF web ACL (and its log group) is optional in some constructs, so it\n  // may be absent. Nothing to do if it is.\n  if (!contents.includes(`new ${logGroupExpr}(this, 'WebAclLogs'`)) {\n    return;\n  }\n\n  // Already migrated (or user-added a removal policy).\n  if (\n    await matchGritQL(\n      tree,\n      file,\n      `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where { $props <: contains \\`removalPolicy\\` }`,\n    )\n  ) {\n    return;\n  }\n\n  // Append the removal policy after the WAF log group's `encryptionKey`\n  // property. The rewrite is scoped to the `WebAclLogs` LogGroup because a\n  // construct can have other log groups sharing the `encryptionKey: logsKey`\n  // shape (e.g. the rest api's access logs).\n  const added = await insertViaGritQL(\n    tree,\n    file,\n    `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where {\n  $props <: contains \\`encryptionKey: logsKey\\` as $enc,\n  $enc => \\`encryptionKey: logsKey,\n      __GRIT_INSERT_PLACEHOLDER__\\`\n}`,\n    `// The log group name is deterministic, so retaining it on delete would\n      // orphan it and block re-creation (e.g. after a rolled-back deploy).\n      removalPolicy: ${construct.removalPolicyExpr}`,\n  );\n\n  if (!added) {\n    nextSteps.push(\n      `${file}: could not add a removal policy to the WAF log group automatically - it may have diverged from the generated shape. Add \\`removalPolicy: ${construct.removalPolicyExpr}\\` to the \\`new ${logGroupExpr}(this, 'WebAclLogs', ...)\\` call so a rolled-back deploy does not orphan the log group.`,\n    );\n    return;\n  }\n\n  if (construct.destructuredImport) {\n    await addDestructuredImport(\n      tree,\n      file,\n      [construct.destructuredImport],\n      'aws-cdk-lib',\n    );\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const construct of WAF_CONSTRUCTS) {\n    await migrateConstruct(tree, construct, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CONSTRUCTS_SRC","WAF_CONSTRUCTS","file","logGroupExpr","removalPolicyExpr","destructuredImport","migrateConstruct","tree","construct","nextSteps","exists","contents","read","includes","added","push","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;CAQC,GAED,MAAMC,iBAAiB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AAmBrE,MAAME,iBAAiC;IACrC;QACEC,MAAM,GAAGF,eAAe,4CAA4C,CAAC;QACrEG,cAAc;QACdC,mBAAmB;IACrB;IACA;QACEF,MAAM,GAAGF,eAAe,qBAAqB,CAAC;QAC9CG,cAAc;QACdC,mBAAmB;QACnBC,oBAAoB;IACtB;CACD;AAED,MAAMC,mBAAmB,OACvBC,MACAC,WACAC;IAEA,MAAM,EAAEP,IAAI,EAAEC,YAAY,EAAE,GAAGK;IAC/B,IAAI,CAACD,KAAKG,MAAM,CAACR,OAAO;QACtB,+DAA+D;QAC/D;IACF;IAEA,MAAMS,WAAWJ,KAAKK,IAAI,CAACV,MAAM,YAAY;IAE7C,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,CAACS,SAASE,QAAQ,CAAC,CAAC,IAAI,EAAEV,aAAa,mBAAmB,CAAC,GAAG;QAChE;IACF;IAEA,qDAAqD;IACrD,IACE,MAAMP,YACJW,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa,iFAAiF,CAAC,GAE1G;QACA;IACF;IAEA,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAMW,QAAQ,MAAMnB,gBAClBY,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa;;;;CAIzB,CAAC,EACE,CAAC;;qBAEgB,EAAEK,UAAUJ,iBAAiB,EAAE;IAGlD,IAAI,CAACU,OAAO;QACVL,UAAUM,IAAI,CACZ,GAAGb,KAAK,0IAA0I,EAAEM,UAAUJ,iBAAiB,CAAC,gBAAgB,EAAED,aAAa,uFAAuF,CAAC;QAEzS;IACF;IAEA,IAAIK,UAAUH,kBAAkB,EAAE;QAChC,MAAMX,sBACJa,MACAL,MACA;YAACM,UAAUH,kBAAkB;SAAC,EAC9B;IAEJ;AACF;AAEA,eAAe,eAAeW,UAC5BT,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,aAAaP,eAAgB;QACtC,MAAMK,iBAAiBC,MAAMC,WAAWC;IAC1C;IAEA,MAAMZ,qBAAqBU;IAE3B,OAAO;QAAEE;IAAU;AACrB"}